中国DOS联盟

Recently researching virus prevention, and finally thought of this simple method
-----------------------------------------------------------------
Now I want to set the following permissions for a certain directory in the NTFS disk:

1. Can create files or subdirectories in this directory, the permissions of subdirectories automatically inherit the permissions of this directory, subdirectories can be renamed, can be deleted
(Naming and deleting are always twin brothers in my experiment)
2. Files copied to (or cut to, or newly created to) this directory become unable to edit content, unable to change attributes, but can be deleted,

3. The attributes of this directory cannot be changed, cannot be deleted, cannot be renamed (this is easy to do, set R permission for the parent directory)
PS: If the requirements of 1, 2, 3 are difficult to achieve simultaneously, you can abandon requirements 1 and 3, and focus on requirement 2!
------------------------------------------------------------------

Thank you in advance!

Off-topic:
Not long ago, I saw a Kingsoft virus-killing tool in the FAT32 partition of drive D. I forgot the specific name, but it has a special write-protect function. It cannot be renamed, cannot be deleted, can be run to kill viruses, and cannot be copied! Using unlocker to check, there are no processes mounted inside. I really admire how the author implemented it? In short, these skills can add a lot of convenience and benefits to our use of the computer.

This post is closed. Please refer to post 5 of this thread for corresponding modifications according to the actual situation.
http://www.cn-dos.net/forum/viewthread.php?tid=48807

Last edited by plp626 on 2009-9-14 at 01:23 ]

I'm currently looking at the parameters of xcacls.vbs: (But it didn't work when I tried it! I don't know where the mistake is!)
Perm: Is for "Files Only" and can be:
Permissions...
F Full control
M Modify
X read & eXecute
R Read
W Write
Advanced...
E Synchronize
D Take Ownership
C Change Permissions
B Read Permissions
A Delete
9 Write Attributes
8 Read Attributes
7 Delete Subfolders and Files
6 Traverse Folder / Execute File
5 Write Extended Attributes
4 Read Extended Attributes
3 Create Folders / Append Data
2 Create Files / Write Data
1 List Folder / Read Data
-------------------------------------------------
XCacls.vbs official introduction:
http://support.microsoft.com/kb/825751
Download address:
http://download.microsoft.com/download/f/7/8/f786aaf3-a37b-45ab-b0a2-8c8c18bbf483/XCacls_Installer.exe

Brother, although we have discussed the following, I still decide to re-read your principles:

1. You can create files in this directory, and you can rename and delete them.
2. You cannot edit the content of any file in the directory, and you cannot change the attributes of any file in the directory.
3. The attributes of this directory cannot be changed, deleted, or renamed.

I think this requirement can actually be achieved like this:
cacls traverses this directory with the attribute set to R.
That is, the directory tree is read-only.

Then you can create new files under this directory tree, and you can make any modifications to this new file.

Of course, my above understanding should be incorrect.
The entire system directory is read-only, but you need to be able to create, delete, and rename files.
I think the current cacls cannot do this.

Last edited by 523066680 on 2009-9-12 at 10:55 ]

I wonder if the registry can do it?
I once used cacls to add permissions to autorun.inf, but it seems the virus used some method to forcibly rename my autorun.inf and then create its own autorun.inf.
Maybe the registry can achieve more detailed restrictions?

参考：http://www.cn-dos.net/forum/viewthread.php?tid=35672#pid242113

Originally posted by HAT at 2009-9-12 11:47 AM:
Reference: http://www.cn-dos.net/forum/viewthread.php?tid=35672#pid242113

It seems that cacls cannot achieve the permission of being able to delete but not modify within a directory.

Regarding the post provided by the moderator, how to achieve the permission of being able to read but not delete a file? As long as the parent directory does not have the delete permission (for the cacls command, just set the parent directory to C permission), I know that.
---------------------------------------------------------------------------------------------
Everyone, think about the methods to prevent files from being infected by viruses. Of course, compressed packages, images, etc. (these methods are not foolproof, and now there are also a few viruses that start to infect compressed packages), etc. can also be used, but none is as simple as what I am going to say.

As for the method mentioned by ifexist, I am using it like this now (adding a command to the right-click - "Set everyone read-only permission for this file", but it is still not very convenient).
It is because it is not convenient that I thought of this method of automatically giving files in the directory the permission of being able to read but not modify.
---------------------------------------------------------------------------------------------
I tried it many times last night and all failed. I read the help of this xcacls.vbs again and want to discuss with you.
3 Create Folders / Append Data
2 Create Files / Write Data //Being able to create a file means being able to write data?! Then it means being able to modify?!
1 List Folder / Read Data

Is my requirement contradictory ?!

1. Files can be created in this directory, and they can be renamed and deleted (I tested, it seems that the ability to delete and rename is "interdependent").
2. Files copied (or cut) into this directory become uneditable and their attributes cannot be changed.
//Files copied in will inherit the settings of the target folder, and files cut in will use the permission settings of the original directory.

3. The attributes of this directory cannot be changed, deleted, or renamed (this is easy to do, set the R permission for the parent directory).
In ACL, just prohibiting the creation of folders can prohibit modifying files.

Originally posted by everest79 at 2009-9-13 07:52 AM:
1. You can create files in this directory, and you can rename and delete them (tested, it seems that deleting and renaming are "symbiotic")
2. Files copied (or cut) into this directory become...

I don't know how to combine the parameters to specifically prohibit creating folders

3 Create Folders / Append Data
2 Create Files / Write Data

From here, creating files and creating directories are separate,

What I said about editing data may be very unprofessional. Looking at the parameter explanations inside, append should be appending data, and write should be creating a new file. I don't know how cacls defines editing data?

Last edited by plp626 on 2009-9-13 at 08:03 ]

3 Create Folders / Append Data 创建文件夹/追加数据 这个禁止掉就不可以修改文件了，但也建立不了文件夹
2 Create Files / Write Data 创建文件/写入数据

Originally posted by everest79 at 2009-9-13 08:05 AM:
3 Create Folders / Append Data Disable this to prevent file modification, but also unable to create folders
2 Create Files / Write Data Create files / write data

The problem is that those parameters are only valid for files,

Perm: Is for "Files Only" and can be:
Permissions...
F Full control
M Modify
X read & eXecute
R Read
W Write
Advanced...
E Synchronize
D Take Ownership
C Change Permissions
B Read Permissions
A Delete

I tried earlier cscript xcacls.vbs test /g adm:F everyone:b148, and the mouse couldn't even open the test directory (not working in the command line either, finally using /t parameter to view as test\*.* ACCESS_DENIED:)
Checked the acl information of the test directory as:
(OI)(IO)(Special access:)
READ_CONTROL --- b
SYNCHRONIZE --- e (don't understand this too much)
FILE_GENERIC_READ ---？
FILE_READ_DATA ---1
FILE_READ_EA ---- 4
FILE_READ_ATTRIBUTES ----8

And the R permission of xcacls.vbs is
(OI)(CI):
READ_CONTROL ----B
SYNCHRONIZE ----E
FILE_GENERIC_READ ---I still don't know which parameter it relates to
FILE_READ_DATA ---1
FILE_READ_EA ---4
FILE_READ_ATTRIBUTES---8

The difference is that b148 is oi+io (only inherit + object inherit) while R is oi+ci (only inherit + container inherit), that is, only the files get the b148 permission, and the directory where the files are located still cannot be accessed,
Now the problem is here, I haven't figured it out yet, just writing out my doubts,

If you want to achieve (create file) + (accessible + not modifiable) + (deletable) need
Create Files ---- 2

Read Data (but this means write date, still that question contradiction?)----1
Read Extended Attributes ---4
Read Attributes ---8
Read Permissions ---b

Delete ---- a
--------------------------------------------- But this is still only valid for files, how to make the files automatically inherit the permissions of the directory?

You directly create a new folder, enter the security settings, remove the inheritance, and then uncheck the option to create folders/append data.

What you mentioned about "canceling" seems to have no specified parameters. I can only indirectly achieve it by using "not granting corresponding permissions", but the directory permission granting in the help information really puzzles me.
---------------------------------------------------------------------
The /I parameter can close the inherited permissions, and it's still in the experimental stage...

/F This will change all
files under the inputed directory but will NOT
traverse sub directories unless /T is also present.
If filename is a directory, and /F is not used, no
files will be touched.

/S This will change all
sub folders under the inputed directory but will NOT
traverse sub directories unless /T is also present.
If filename is a directory, and /S is not used, no
sub directories will be touched.

/T Traverses each
subdirectory and makes the same changes.
This switch will traverse directories only if the
filename is a directory or is using wildcards.

The meanings expressed by these parameters are hard to understand. The /t parameter is for directories, but what's the use of this.

There are really few usage examples of xcacls.vbs, and what's searched online are only the official help...

Last edited by plp626 on 2009-9-13 at 09:48 ]

I just didn't say to use a script, directly modify manually

Originally posted by everest79 at 2009-9-13 09:48 AM:
I just didn't say to use a script, directly modify manually

No, I can't.

Create a folder on the desktop, then right - click and select Properties, then select the Security page, then click Advanced. First, uncheck the box for inheriting from the parent, apply, then select your current user name, click Edit, go in and uncheck the box for Create folders/Append data, then apply and confirm.