MAKEMSI quickly and reliably creates MSI files in a non-programmatic way
Have your say! Join the MAKEMSI discussion list or view archive! Suggest improvements. No question too simple or too complex.
[Bottom][Contents][Prev]: AbortIf[Next]: AccessApply
Have your say! Join the MAKEMSI discussion list or view archive! Suggest improvements. No question too simple or too complex.
\->Source Code->Commands->Access

The "Access" Command - Defines Access permissions

This command is used as a simple way of predefining user access permissions which may be used on the "File", "Files", "Directory", "DirectoryTree", "Registry" and "AccessApply" commands. The permissions are applied when the relevant objects are installed.

The "LockPermissions" table will be updated as required when the alias is referred to, it is recommended that you read its documentation. It is also suggested that you have a look at the "Security Related Tools" section.

This command does not on its own modify the database in any way, it simply allows you to predefine the possibly common access requirements (for example in a common header file).

The macro takes these parameters:

Main Access Related Options

Please see the "options for commands" section of the manual.

#define? DEFAULT_ACCESS_USERS
#define? DEFAULT_ACCESS_ACCESS                            GENERIC_ALL
#define? ACCESS_ROW_INSERTIONS_LockPermissions_@VALIDATE  NEW -MISSINGDATA      ;;Some msis don't have "_Validation" data

Test Well!

To be sure it works you must test it by installing the product and checking the security settings (this is particularly tree if setting permissions on registry keys). Prior to Windows XP you should use "RegEdt32.exe" or in Windows XP "regedit.exe" can do this.

The required process to set registry keys can be very problematic and is in fact unreliable (a Windows Install "hole"). There is no documented way to be positive that it will work.

What I have found is that it can be made to work under certain conditions. The setting of permissions will always fail if you write to any registry values within the key "before" you define the key so place this sort of code at or near the very top of your script.

As the ordering is important you should check the order of keys within the "Component" table and then the "Registry" table with "ORCA". The order shown by "ORCA" (before any column is sorted) is, I think, the order of application.

If it fails to work you will not be told and nothing seems to be logged either way in any verbose log. This is just another Windows Installer "feature" (well this is Windows after all).

Note that it is OK for the registry key to exist prior to application of the security settings.

EXAMPLE - File Command

<$Access "Admin(complete)"              Users="Administrators SYSTEM" Access="GENERIC_ALL">
<$Access "AuthenticatedUsers(ReadOnly)" Users=^'Authenticated Users'^ Access="GENERIC_READ GENERIC_EXECUTE">
#(
    <$File
                   Access="Admin(complete) AuthenticatedUsers(ReadOnly)"
                   Source="<$SOURCE_DIR>\SomeFile.ini"
              Destination="[INSTALLDIR]\SomeFile.ini"
        Options4Component=^ComponentId=''^              ;;Don't want repair or uninstall of this file
                   EXLIST="SomeFile.ini"
    >
#)

EXAMPLE - Sundry

;--- Define a directory with specific permisions ----------------------------
<$Access "GenericAllAdmin"    Users="Administrators"  Access="GENERIC_ALL">
<$Access "ReadOnlySomeUsers"  Users="Dennis Linda"    Access="GENERIC_READ">
<$DirectoryTree Key="SOMEDIR" Dir="D:\SomeDir" ACCESS="GenericAllAdmin ReadOnlySomeUsers" MAKE="Y" REMOVE="Y">


;--- Define different access details (used below) ---------------------------
<$Access "GenericAll"  Users="Administrators Dennis"  Access="GENERIC_ALL">
<$Access "GenericRead" Users="Administrators Dennis " Access="GENERIC_READ">
<$Access "STUPID"      Users="Administrators Dennis"  Access="FILE_READ_DATA FILE_APPEND_DATA FILE_READ_ATTRIBUTES">

;--- Set file permissions ---------------------------------------------------
<$File Source=".\reg4mm.exe" Destination="[INSTALLDIR]\TestExe.exe" ACCESS="GenericAll">
<$Files 'c:\tmp\s*.vbs' ExList="Fred" DestDir='INSTALLDIR'          ACCESS="GenericRead">

;--- Set registry permissions -----------------------------------------------
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING1-Stupid'   Value="1234" ACCESS="STUPID">
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly1' Value="1234" ACCESS="GenericRead">
<$Registry HKEY="CURRENT_USER" Key="Software\DENNIS\PermTest" Name='STRING_ReadOnly2' Value="1234" ACCESS="GenericRead">


Microsoft awarded me an MVP (Most Valuable Professional award) in 2004, 2005, 2006, 2007, 2008 & 2009 for the Windows SDK (Windows Installer) area.Please email me any feedback, additional information or corrections.
See this page online (look for updates)

[Top][Contents][Prev]: AbortIf[Next]: AccessApply


MAKEMSI© is (C)opyright Dennis Bareis 2003-2008 (All rights reserved).
Saturday May 28 2022 at 3:11pm
Visit MAKEMSI's Home Page
Microsoft awarded me an MVP (Most Valuable Professional award) in 2004, 2005, 2006, 2007, 2008 & 2009 for the Windows SDK (Windows Installer) area.