MAKEMSI quickly and reliably creates MSI files in a non-programmatic way\Source CodeCommandsAccess

---

The "Access" Command - Defines Access permissions

This command is used as a simple way of predefining user access permissions which may be used on the "File", "Files", "Directory", "DirectoryTree", "Registry" and "AccessApply" commands. The permissions are applied when the relevant objects are installed.

The "LockPermissions" table will be updated as required when the alias is referred to, it is recommended that you read its documentation. It is also suggested that you have a look at the "Security Related Tools" section.

This command does not on its own modify the database in any way, it simply allows you to predefine the possibly common access requirements (for example in a common header file).

The macro takes these parameters:

• Alias Name (positional)
  This is a case insensitive alias name which other commands will refer to when specifying that they need permissions set. The alias must not contain spaces but can contain virtually any other character.

• Access (required)
  This is an integer which represents the required permissions. This is used in the "Permission" column of the "LockPermissions" table.

  The value should be a space separated list of decimal integers or one of the following predefined permissions:

  • FILE_READ_DATA
  • FILE_WRITE_DATA
  • FILE_APPEND_DATA
  • FILE_READ_EA
  • FILE_WRITE_EA
  • FILE_EXECUTE
  • FILE_DELETE_CHILD
  • FILE_READ_ATTRIBUTES
  • FILE_WRITE_ATTRIBUTES
  • DELETE
  • READ_CONTROL
  • WRITE_DAC
  • WRITE_OWNER
  • SYNCHRONIZE
  • ACCESS_SACL
  • ACCESS_SYSTEM_SECURITY
  • MAXIMUM_ALLOWED
  • GENERIC_ALL
  • GENERIC_EXECUTE
  • GENERIC_WRITE
  • GENERIC_READ

  The default for this parameter can be set via the DEFAULT_ACCESS_ACCESS macro. This is initially "GENERIC_ALL".

• Users (required)
  This is a space separated list of localized user (or group) names which may include a domain name, examples are "user1" and "domainname\username". If you have multiple domains with the same user id you can leave off the domain (the "current" domain will be used - if not local?). There is a tool which helps with using the "LockPermissions" table on localized windows versions.

  Note that user (and group) names can contain spaces so a space separated list may not have been the best idea however you can quote the user name if required...

  Microsoft document the "Well-known security identifiers in Windows operating systems" in KB243330.

  Windows Installer clears any existing ACL and replaces it with the information you provide here so include all users. Windows Installer always adds full access to the system account. If this is not desired then you will need an alternative way of setting permissions, have a look at the "Security Related Tools" section.

  The default for this parameter can be set via the DEFAULT_ACCESS_USERS macro. This is initially "".

Main Access Related Options

Please see the "options for commands" section of the manual.

#define? DEFAULT_ACCESS_USERS
#define? DEFAULT_ACCESS_ACCESS                            GENERIC_ALL
#define? ACCESS_ROW_INSERTIONS_LockPermissions_@VALIDATE  NEW -MISSINGDATA      ;;Some msis don't have "_Validation" data

Test Well!

To be sure it works you must test it by installing the product and checking the security settings (this is particularly tree if setting permissions on registry keys). Prior to Windows XP you should use "RegEdt32.exe" or in Windows XP "regedit.exe" can do this.

The required process to set registry keys can be very problematic and is in fact unreliable (a Windows Install "hole"). There is no documented way to be positive that it will work.

What I have found is that it can be made to work under certain conditions. The setting of permissions will always fail if you write to any registry values within the key "before" you define the key so place this sort of code at or near the very top of your script.

As the ordering is important you should check the order of keys within the "Component" table and then the "Registry" table with "ORCA". The order shown by "ORCA" (before any column is sorted) is, I think, the order of application.

If it fails to work you will not be told and nothing seems to be logged either way in any verbose log. This is just another Windows Installer "feature" (well this is Windows after all).

Note that it is OK for the registry key to exist prior to application of the security settings.

EXAMPLE - File Command

<$Access "Admin(complete)"              Users="Administrators SYSTEM" Access="GENERIC_ALL">
<$Access "AuthenticatedUsers(ReadOnly)" Users=^'Authenticated Users'^ Access="GENERIC_READ GENERIC_EXECUTE">
#(
    <$File
                   Access="Admin(complete) AuthenticatedUsers(ReadOnly)"
                   Source="<$SOURCE_DIR>\SomeFile.ini"
              Destination="[INSTALLDIR]\SomeFile.ini"
        Options4Component=^ComponentId=''^              ;;Don't want repair or uninstall of this file
                   EXLIST="SomeFile.ini"
    >
#)

EXAMPLE - Sundry

;--- Define a directory with specific permisions ----------------------------
<$Access "GenericAllAdmin"    Users="Administrators"  Access="GENERIC_ALL">
<$Access "ReadOnlySomeUsers"  Users="Dennis Linda"    Access="GENERIC_READ">
<$DirectoryTree Key="SOMEDIR" Dir="D:\SomeDir" ACCESS="GenericAllAdmin ReadOnlySomeUsers" MAKE="Y" REMOVE="Y">


;--- Define different access details (used below) ---------------------------
<$Access "GenericAll"  Users="Administrators Dennis"  Access="GENERIC_ALL">
<$Access "GenericRead" Users="Administrators Dennis " Access="GENERIC_READ">
<$Access "STUPID"      Users="Administrators Dennis"  Access="FILE_READ_DATA FILE_APPEND_DATA FILE_READ_ATTRIBUTES">

;--- Set file permissions ---------------------------------------------------
<$File Source=".\reg4mm.exe" Destination="[INSTALLDIR]\TestExe.exe" ACCESS="GenericAll">
<$Files 'c:\tmp\s*.vbs' ExList="Fred" DestDir='INSTALLDIR'          ACCESS="GenericRead">

;--- Set registry permissions -----------------------------------------------
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING1-Stupid'   Value="1234" ACCESS="STUPID">
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly1' Value="1234" ACCESS="GenericRead">
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly2' Value="1234" ACCESS="GenericRead">

Please email me any feedback, additional information or corrections. See this page online (look for updates) MAKEMSI© is (C)opyright Dennis Bareis 2003-2008 (All rights reserved). Saturday May 28 2022 at 3:11pm Visit MAKEMSI's Home Page