permission rules

src/Service/Installer.cs

@@ -40,34 +40,33 @@ namespace Service
 
         private void AfterInstalled(object sender, InstallEventArgs e)
         {
-            if(!Directory.Exists(Constants.BaseStoragePath))
+            var info = new DirectoryInfo(Constants.BaseStoragePath);
+            if(!info.Exists)
             {
-                Directory.CreateDirectory(Constants.BaseStoragePath);
+                info.Create();
             }
 
-            var info = new DirectoryInfo(Constants.BaseStoragePath);
             var sec = info.GetAccessControl();
-
+            AddPermission(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), sec);
-            var adminRule = new FileSystemAccessRule(
+            AddPermission(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null), sec);
-                new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null),
+            AddPermission(new SecurityIdentifier(WellKnownSidType.BuiltinUsersSid, null), sec);
-                FileSystemRights.FullControl | FileSystemRights.Write | FileSystemRights.Read,
+            AddPermission(new SecurityIdentifier(WellKnownSidType.CreatorOwnerSid, null), sec);
-                InheritanceFlags.None,
+            AddPermission(WindowsIdentity.GetCurrent().User, sec);
-                PropagationFlags.NoPropagateInherit,
-                AccessControlType.Allow);
-            sec.AddAccessRule(adminRule);
-
-            var userRule = new FileSystemAccessRule(
-                WindowsIdentity.GetCurrent().Name,
-                FileSystemRights.FullControl | FileSystemRights.Write | FileSystemRights.Read,
-                InheritanceFlags.None,
-                PropagationFlags.NoPropagateInherit,
-                AccessControlType.Allow);
-            sec.AddAccessRule(userRule);
-
             sec.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
             info.SetAccessControl(sec);
         }
 
+        private void AddPermission(IdentityReference sid, DirectorySecurity sec)
+        {
+            var rule = new FileSystemAccessRule(
+                sid,
+                FileSystemRights.FullControl | FileSystemRights.Write | FileSystemRights.Read,
+                InheritanceFlags.None,
+                PropagationFlags.NoPropagateInherit,
+                AccessControlType.Allow);
+            sec.AddAccessRule(rule);
+        }
+
         private void BeforeInstalled(object sender, InstallEventArgs e)
         {
             if(EventLog.SourceExists(_serviceInstaller.ServiceName))