From 4f0d3876e36a5805ee67ca1d6a11f88370856480 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sun, 25 Jun 2023 12:34:33 -0400 Subject: [PATCH] Set ACL info in configure script --- .../Program.cs | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs b/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs index 0739060cfe..13b2ae64c3 100644 --- a/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs +++ b/build/package/winget/Tgstation.Server.Host.Service.Configure/Program.cs @@ -3,6 +3,7 @@ using System.Diagnostics; using System.IO; using System.Linq; using System.Reflection; +using System.Security.AccessControl; using System.Threading; using var process = new Process(); @@ -57,14 +58,27 @@ foreach (var installLogFile in Directory.EnumerateFiles(installDir, "*.log")) File.Delete(installLogFile); if (uninstall) -{ Directory.Delete( Path.Combine(installDir, "lib"), true); -} if ((shortcut || (interactive && !uninstall)) && process.ExitCode == 0) { + // try and lockdown the appsettings file + var fileInfo = new FileInfo("appsettings.Production.yml"); + + //get security access + FileSecurity fs = fileInfo.GetAccessControl(); + + //remove inherited access + fs.SetAccessRuleProtection(true, false); + + // Explicitly grant admins and SYSTEM + fs.AddAccessRule(new FileSystemAccessRule("Administrators", FileSystemRights.FullControl, AccessControlType.Allow)); + fs.AddAccessRule(new FileSystemAccessRule("SYSTEM", FileSystemRights.Read, AccessControlType.Allow)); + + fileInfo.SetAccessControl(fs); + var startServer = interactive; if (shortcut) {