Search code examples
windowsnsisfile-permissionsuser-permissions

Allow File to be Read by Non-Admin User Process

My installer runs with elevated privileges and writes a file (A) to $APPDATA (C:/ProgramData) aswell as writting files to $PROGRAMFILES. File A is a .addin file read by an application called Revit.

My Problem: Because the file A is created by an admin process, this file is unable to be read by Revit when the user is a Non-Admin windows user.

I would like to edit the file A so that it can be read by the a Non-Admin windows user but I dont know how. Can you suggest how I can achieve this?

I have tried using the NSIS function SetFileAttributes "myFilePath.addin" NORMAL but this doesn't work.

Note: I am aware I could run my installer without elevated privileges and then Revit could read the file but as I mentioned above my installer also writes to $PROGRAMFILES so I need elevated privileges.

Solution

  • Use the AccessControl plugin to change the DACL:

    ; This gives read access to the everyone group, use (BU) or (S-1-5-32-545) for BUILTIN\Users
AccessControl::GrantOnFile "$INSTDIR\myfile" "(S-1-1-0)" "GenericRead"