The "Access" Command - Defines Access permissions |
This command is used as a simple way of predefining user access permissions which may be used on the "File", "Files", "Directory", "DirectoryTree", "Registry" and "AccessApply" commands. The permissions are applied when the relevant objects are installed.
The "LockPermissions" table will be updated as required when the alias is referred to, it is recommended that you read its documentation. It is also suggested that you have a look at the "Security Related Tools" section.
This command does not on its own modify the database in any way, it simply allows you to predefine the possibly common access requirements (for example in a common header file).
The macro takes these parameters:
The value should be a space separated list of decimal integers or one of the following predefined permissions:
The default for this parameter can be set via the DEFAULT_ACCESS_ACCESS macro. This is initially "GENERIC_ALL".
Note that user (and group) names can contain spaces so a space separated list may not have been the best idea however you can quote the user name if required...
Microsoft document the "Well-known security identifiers in Windows operating systems" in KB243330.
Windows Installer clears any existing ACL and replaces it with the information you provide here so include all users. Windows Installer always adds full access to the system account. If this is not desired then you will need an alternative way of setting permissions, have a look at the "Security Related Tools" section.
The default for this parameter can be set via the DEFAULT_ACCESS_USERS macro. This is initially "".
Main Access Related Options |
Please see the "options for commands" section of the manual.
#define? DEFAULT_ACCESS_USERS #define? DEFAULT_ACCESS_ACCESS GENERIC_ALL #define? ACCESS_ROW_INSERTIONS_LockPermissions_@VALIDATE NEW -MISSINGDATA ;;Some msis don't have "_Validation" data
Test Well! |
To be sure it works you must test it by installing the product and checking the security settings (this is particularly tree if setting permissions on registry keys). Prior to Windows XP you should use "RegEdt32.exe" or in Windows XP "regedit.exe" can do this.
The required process to set registry keys can be very problematic and is in fact unreliable (a Windows Install "hole"). There is no documented way to be positive that it will work.
What I have found is that it can be made to work under certain conditions. The setting of permissions will always fail if you write to any registry values within the key "before" you define the key so place this sort of code at or near the very top of your script.
As the ordering is important you should check the order of keys within the "Component" table and then the "Registry" table with "ORCA". The order shown by "ORCA" (before any column is sorted) is, I think, the order of application.
If it fails to work you will not be told and nothing seems to be logged either way in any verbose log. This is just another Windows Installer "feature" (well this is Windows after all).
Note that it is OK for the registry key to exist prior to application of the security settings.
EXAMPLE - File Command |
<$Access "Admin(complete)" Users="Administrators SYSTEM" Access="GENERIC_ALL"> <$Access "AuthenticatedUsers(ReadOnly)" Users=^'Authenticated Users'^ Access="GENERIC_READ GENERIC_EXECUTE"> #( <$File Access="Admin(complete) AuthenticatedUsers(ReadOnly)" Source="<$SOURCE_DIR>\SomeFile.ini" Destination="[INSTALLDIR]\SomeFile.ini" Options4Component=^ComponentId=''^ ;;Don't want repair or uninstall of this file EXLIST="SomeFile.ini" > #)
EXAMPLE - Sundry |
;--- Define a directory with specific permisions ---------------------------- <$Access "GenericAllAdmin" Users="Administrators" Access="GENERIC_ALL"> <$Access "ReadOnlySomeUsers" Users="Dennis Linda" Access="GENERIC_READ"> <$DirectoryTree Key="SOMEDIR" Dir="D:\SomeDir" ACCESS="GenericAllAdmin ReadOnlySomeUsers" MAKE="Y" REMOVE="Y"> ;--- Define different access details (used below) --------------------------- <$Access "GenericAll" Users="Administrators Dennis" Access="GENERIC_ALL"> <$Access "GenericRead" Users="Administrators Dennis " Access="GENERIC_READ"> <$Access "STUPID" Users="Administrators Dennis" Access="FILE_READ_DATA FILE_APPEND_DATA FILE_READ_ATTRIBUTES"> ;--- Set file permissions --------------------------------------------------- <$File Source=".\reg4mm.exe" Destination="[INSTALLDIR]\TestExe.exe" ACCESS="GenericAll"> <$Files 'c:\tmp\s*.vbs' ExList="Fred" DestDir='INSTALLDIR' ACCESS="GenericRead"> ;--- Set registry permissions ----------------------------------------------- <$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING1-Stupid' Value="1234" ACCESS="STUPID"> <$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly1' Value="1234" ACCESS="GenericRead"> <$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly2' Value="1234" ACCESS="GenericRead">