blocks|key|3132522|text|不，文件权限是由文件系统处理的，文件系统在系统中的级别比运行C#代码的级别低得多。C#代码不能直接绕过文件系统安全性。如果应用程序作为schmoe_j运行，它就不能写入schmoe_j没有写访问权限的磁盘上的位置。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3132523|一个例外情况是，如果schmoe_j具有备份和还原权限，在这种情况下，他可以写入磁盘上的任何位置。普通用户没有这个特权，因为授予它是一个非常危险的特权。|3132524|还有其他理论上的方法-例如，如果机器上有一个不安全的服务，标准用户可以说服它写入磁盘上的任意位置。任何这样的情况都是一个应该修复的安全漏洞。|3132525|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

No, permissions on files are handled by the file system which is at a much lower level in the system than C# code runs as. C# code can't directly bypass file system security. If the application runs as schmoe_j it can't write to locations on disk that schmoe_j doesn't have write-access to.

One exception is if schmoe_j has backup &amp; restore privileges, in which case he can write to anywhere on disk. Normal users don't have this privilege because it is a very dangerous privilege to grant.

There are other theoretical ways - for example, if an insecure service is on the box that can be persuaded by a standard user to write to an arbitrary place on disk. Any such cases is a security hole that should be fixed.

blocks|key|816294|text|根据所使用的类，当您没有适当的权限写入目录时，通常会抛出异常。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|816295|例如，根据MSDN的说法，当调用File.Create和File.Copy时，当调用者没有所需的权限时，将抛出UnauthorizedAccessException。|offset|length|style|CODE|816296|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/d62kzs03.aspx|1|http://msdn.microsoft.com/en-us/library/c6cfw35a.aspx^0|0|1J|R|G|B|0|S|9|1|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@$D|T|E|U|F|G]]|9|@$D|V|E|W|1|X]|$D|Y|E|Z|1|10]]|A|$]]|$1|H|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]|P|$5|K|L|M|A|$N|Q]]]]

Depending on the class being used, usually an exception will be thrown when you don't have proper permissions to write to a directory.

As an example, according to MSDN, when calling <a href="http://msdn.microsoft.com/en-us/library/d62kzs03.aspx" rel="nofollow noreferrer">File.Create</a> and <a href="http://msdn.microsoft.com/en-us/library/c6cfw35a.aspx" rel="nofollow noreferrer">File.Copy</a>, an <code>UnauthorizedAccessException</code> will be thrown when the caller does not have the required permissions.

blocks|key|3132593|text|您可以在可执行文件中包含清单，以请求以更高的权限运行应用程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3132594|参见Adding+a+UAC+Manifest+to+Managed+Code。|offset|length|3132595|entityMap|0|LINK|mutability|MUTABLE|url|http://blogs.msdn.com/shawnfa/archive/2006/04/06/568563.aspx^0|0|2|11|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

You can include an Manifest with your executable to request that the application is run with higher privileges.

See <a href="http://blogs.msdn.com/shawnfa/archive/2006/04/06/568563.aspx" rel="nofollow noreferrer">Adding a UAC Manifest to Managed Code</a>.

blocks|key|3132641|text|我认为通常的处理方式是使用一个服务(或服务应用程序)，该服务(或服务应用程序)在提升的权限下运行，但具有非常小的外围应用程序区域，并且没有GUI。用户与在较低权限下运行的应用程序进行交互，这将完成用户帐户可以做的事情-将文件放在dropoff文件夹中，写入数据库等。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3132642|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I think normally the way this is handed is to use a service (or service application) which runs under elevated permissions but with a very small surface area and no GUI. The user interacts with an application running under lower permissions which would do things that user's account can do - place files in a dropoff folder, write to a database, etc. Think IIS, MMC, TrustedInstaller, etc.

blocks|key|3132679|text|应用程序将在用户权限下运行，如果用户不能这样做，那么应用程序也不能这样做。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3132680|但是，应用程序可以尝试模拟另一个用户，在这种情况下，它将能够访问该目录。这涉及到应用程序暂时获得另一个用户的权限。这就是ASP.NET通常的工作方式。|3132681|结果是，用户必须提供被模拟用户的凭据。|3132682|Article演示了这一点。|offset|length|3132683|entityMap|0|LINK|mutability|MUTABLE|url|http://www.codeproject.com/KB/cs/cpimpersonation1.aspx^0|0|0|0|0|7|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@$H|V|I|W|1|X]]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

The application will run under the user's rights, if the user can;t do it, the application can't do it.

HOWEVER, the application can attempt to impersonate another user, in which case it would be able to gain access to that directory. This involved the app temporarily gaining the rights of another user. this is how ASP.NET works quite often.

The up-shot is that the user would have to provide the credentials of the impersonated user.

<a href="http://www.codeproject.com/KB/cs/cpimpersonation1.aspx" rel="nofollow noreferrer">Article</a> demonstrating this.

blocks|key|3132712|text|他能运行这个应用吗？是。当它试图复制这些文件时，它将抛出一个UnauthorizedAccessException，但不是在此之前。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3132713|entityMap^0|U|R|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

Can he run the app? Yes. It will throw an <code>UnauthorizedAccessException</code> when it tries to copy those files, but not before.

Can user schmoe_j run an app that copies files to a directory that schmoe_j can't write to?

C# application-level permissions greater than user's?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

用户schmoe_j是否可以运行将文件复制到schmoe_j无法写入的目录的应用程序？

问C#应用程序级权限是否高于用户的权限？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问C#应用程序级权限是否高于用户的权限？EN