Using cacls.exe to set permissions in Wix?

[JT]

it is advisable to use cacls.exe as a custom action to set folder/files
permissions in wix? if so, what is the proper way to reference to
cacls.exe and pass in the parameters to set the permissions. i am
attempting to set permissions on an installed folder.

i have tried to use the <Permission /> provided in wix but the level of
control is not sufficient.

thanks.

[Gary Chang[MSFT]]

Hi JT,

Since the Wix tool is not Microsoft's product, I suggest you can post the
problem to the mailing list of the Wix project at the SourceForge for help,
you'd get better and specific help.

By the way, for the issue about set permissions in a MSI package, please
refer to the following MSDN KB article:

How To Set Permissions Using the LockPermissions Table
http://support.microsoft.com/?id=288975

Thanks for your understanding!

Best regards,

Gary Chang
Microsoft Community Support
--------------------
Get Secure! ：C www.microsoft.com/security
Register to Access MSDN Managed Newsgroups!
http://support.microsoft.com/default.aspx?scid=/servicedesks/msdn/nospam.asp
&SD=msdn

This posting is provided "AS IS" with no warranties, and confers no rights.

[Christopher Painter]

""Gary Chang[MSFT]"" <v-ga...@online.microsoft.com> wrote in message
news:cTj3c5J...@TK2MSFTNGXA01.phx.gbl...

> Since the Wix tool is not Microsoft's product, I suggest you can post the
> problem to the mailing list of the Wix project at the SourceForge for
> help,
> you'd get better and specific help.

Wasn't WiX released by Microsoft under the CPL license?

> By the way, for the issue about set permissions in a MSI package, please
> refer to the following MSDN KB article:
>
> How To Set Permissions Using the LockPermissions Table
> http://support.microsoft.com/?id=288975

Many of us, including Rob Mensching, have reasons to not use
LockPermissions. BTW I'm pretty new to Wix myself but I believe WiX has a
SecureObj extension that enhances the functionality of ACL manipulation over
what LockPermissions can do.

[Richard [Microsoft Windows Installer MVP]]

[Please do not mail me a copy of your followup]

"Christopher Painter" <Christoph...@discussions.microsoft.com> spake the secret code
<G0Jve.123$Ox3...@newssvr12.news.prodigy.com> thusly:

>Many of us, including Rob Mensching, have reasons to not use

>LockPermissions. [...]

The biggest problem with LockPermissions is that it only works for a
few well-known SIDs without requiring a custom action.

Once it requires a custom action, you might as well just use cacls.exe
or something equivalent to set permissions.

MSI needs a better facility for manipulating ACLs and accounts -- they
are intimately tied together as often times you want to do things like
create a local group and assign appropriate permissions for the group
to directories, files, registry entries, etc.
--
"The Direct3D Graphics Pipeline"-- code samples, sample chapter, FAQ:
<http://www.xmission.com/~legalize/book/>
Pilgrimage: Utah's annual demoparty
<http://pilgrimage.scene.org>

[Christopher Painter]

"Richard [Microsoft Windows Installer MVP]"
<legaliz...@mail.xmission.com> wrote in message

> The biggest problem with LockPermissions is that it only works for a
> few well-known SIDs without requiring a custom action.
>
> Once it requires a custom action, you might as well just use cacls.exe
> or something equivalent to set permissions.
>
> MSI needs a better facility for manipulating ACLs and accounts -- they
> are intimately tied together as often times you want to do things like
> create a local group and assign appropriate permissions for the group
> to directories, files, registry entries, etc.

I agree with you. The other 2 big problems for me have been

1) I don't see a way for LockPermissions to support W2K style permission
propogations. Whatever I set it to is absolute. Seeing how MSI was
released with W2K I see this as a huge oversight. Only logic I can come up
with for this is the thought that many permission problems could be solved
with proper application development ( then "don't do that!" requirement )

2) I have seen where permissions don't get set on existing objects. I'm
assuming this is a costing issue... it exists, don't need to install the
component hence permissions don't get set. I'm not sure this is exactly
what is going on because I abandoned LockPermissions for a CA.

[Bugbear.1973]

I absolutely agree with all the previous posters who have given up on
using the LockPermissions table. I'm not a software developer but a
software repackager. Often times I encounter a package that needs
elevated rights on securable objects. LockPermissions is useless
because it replaces perms (at least, I've never come across a scenario
where it merges perms), and because it does nothing for propogating
changes down a tree.

A CA using SetACL.exe is much more versatile...

My $0.02

[Yan-Hong Huang[MSFT]]

Hi Christopher,

Wix is included in one of our shared source programs. For getting support
on this project, please refer to this web link:
http://sourceforge.net/support/getsupport.php?group_id=105970

That should be the right place to get support on Wix. Thanks very much for
your understanding.

Best regards,
Yanhong Huang
Microsoft Community Support

Get Secure! ¨C www.microsoft.com/security
Register to Access MSDN Managed Newsgroups!

-http://support.microsoft.com/default.aspx?scid=/servicedesks/msdn/nospam.as

[Christopher Painter]

"Yan-Hong Huang[MSFT]" <yhh...@online.microsoft.com> wrote in message
news:F2EJWfFf...@TK2MSFTNGXA01.phx.gbl...

> Hi Christopher,
>
> Wix is included in one of our shared source programs. For getting support
> on this project, please refer to this web link:
> http://sourceforge.net/support/getsupport.php?group_id=105970
>
> That should be the right place to get support on Wix. Thanks very much for
> your understanding.

Thanks, I'm already a member of the WIX-USERS and WIX-DEVS lists. I was
just trying to help the orginial poster.

Thanks,
Chris

[Yan-Hong Huang[MSFT]]

That is nice. :)

Thanks for participating the community.