File security weirdness createing file.

23 Dec 2005 6:14 PM

David Thielen

Hi;

I am creating png files in my ASP .NET app. When I am running under Windows
2003/IIS 6, the file is not given the security permissions it should have. It
does not have any permission for several users that the directory it is in
has, including IUSR_JASMINE (my system is named jasmine).

Here is the weird part. In my aps .net code I have the following:
String jname = Request.PhysicalApplicationPath + "images\\java_" + fileNum +
".txt";
java.io.FileOutputStream fos = new java.io.FileOutputStream(jname);

The above works fine - the created file has the right permissions.

But when my code calls a C# dll that calls a J# dll and that dll uses the
exact same call to new FileOutputStream, I get the vastly reduced set of
permissions.

On XP & IIS 5, this is not a problem.

Any ideas?

--
thanks - dave

23 Dec 2005 7:36 PM

David Thielen

Make that "creating" file.

One note - both DLLs are strongly named and code signed.

Do I need to put them in the Web.Config file somewhere. Or does IIS 6.0 have
to be told they can create files somewhere?

thanks - dave

24 Dec 2005 4:58 AM

Kevin Yu [MSFT]

Hi dave,

We have reviewed this issue and are currently researching on it. We will
update you ASAP. Thanks for your patience!

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

26 Dec 2005 11:53 AM

Steven Cheng[MSFT]

Hi Dave,

So the context seems a bit complex. Would you try the test by creating two
simplified dlls (c# and J#) ,and both of them only contains the required
file IO operation as in your application to see whether it can reproduce
the problem? If so, we may try performing some local test through the
simplified code ....

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

--------------------
Show quoteHide quote

microsoft.public.dotnet.framework.aspnet:366842
Show quoteHide quote

| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Make that "creating" file.
|
| One note - both DLLs are strongly named and code signed.
|
| Do I need to put them in the Web.Config file somewhere. Or does IIS 6.0
have
| to be told they can create files somewhere?
|
| thanks - dave
|

28 Dec 2005 10:33 PM

David Thielen

Hi;

Ok, I found it. The problem is the J# call File.createTempFile().

--
thanks - dave

Show quoteHide quote

"Steven Cheng[MSFT]" wrote:

> Hi Dave,
>
> So the context seems a bit complex. Would you try the test by creating two
> simplified dlls (c# and J#) ,and both of them only contains the required
> file IO operation as in your application to see whether it can reproduce
> the problem? If so, we may try performing some local test through the
> simplified code ....
>
> Regards,
>
> Steven Cheng
> Microsoft Online Support
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>
>
>
> --------------------
> | Thread-Topic: File security weirdness createing file.
> | thread-index: AcYH+BvnYTf0B0VySuysMkpMxRuZvQ==
> | X-WBNR-Posting-Host: 199.45.247.98
> | From: "=?Utf-8?B?RGF2aWQgVGhpZWxlbg==?=" <thielen@nospam.nospam>
> | References: <062BEA43-CEB8-4C31-A031-2BB698FF2***@microsoft.com>
> | Subject: RE: File security weirdness createing file.
> | Date: Fri, 23 Dec 2005 11:36:02 -0800
> | Lines: 8
> | Message-ID: <B656DB8F-3069-40EB-A657-71F25C5BF***@microsoft.com>
> | MIME-Version: 1.0
> | Content-Type: text/plain;
> | charset="Utf-8"
> | Content-Transfer-Encoding: 7bit
> | X-Newsreader: Microsoft CDO for Windows 2000
> | Content-Class: urn:content-classes:message
> | Importance: normal
> | Priority: normal
> | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
> | Newsgroups: microsoft.public.dotnet.framework.aspnet
> | NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
> | Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
> | Xref: TK2MSFTNGXA02.phx.gbl
> microsoft.public.dotnet.framework.aspnet:366842
> | X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
> |
> | Make that "creating" file.
> |
> | One note - both DLLs are strongly named and code signed.
> |
> | Do I need to put them in the Web.Config file somewhere. Or does IIS 6.0
> have
> | to be told they can create files somewhere?
> |
> | thanks - dave
> |
>
>

29 Dec 2005 1:39 AM

Steven Cheng[MSFT]

Thanks for your followup.

Glad that you've figured out the problem and the file api works well...

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

--------------------

| Thread-Topic: File security weirdness createing file.
| thread-index: AcYL/qp5eci/KACJS9mUVIjxWQ+p/Q==
| X-WBNR-Posting-Host: 199.45.247.98
| From: "=?Utf-8?B?RGF2aWQgVGhpZWxlbg==?=" <thielen@nospam.nospam>
| References: <062BEA43-CEB8-4C31-A031-2BB698FF2***@microsoft.com>

<B656DB8F-3069-40EB-A657-71F25C5BF***@microsoft.com>
<QYN4AMhCGHA.3***@TK2MSFTNGXA02.phx.gbl>
Show quoteHide quote

microsoft.public.dotnet.framework.aspnet:367419
Show quoteHide quote

| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Hi;
|
| Ok, I found it. The problem is the J# call File.createTempFile().
|
| --
| thanks - dave
|
|
| "Steven Cheng[MSFT]" wrote:
|
| > Hi Dave,
| >
| > So the context seems a bit complex. Would you try the test by creating
two
| > simplified dlls (c# and J#) ,and both of them only contains the
required
| > file IO operation as in your application to see whether it can
reproduce
| > the problem? If so, we may try performing some local test through the
| > simplified code ....
| >
| > Regards,
| >
| > Steven Cheng
| > Microsoft Online Support
| >
| > Get Secure! www.microsoft.com/security
| > (This posting is provided "AS IS", with no warranties, and confers no
| > rights.)
| >
| >
| >
| > --------------------
| > | Thread-Topic: File security weirdness createing file.
| > | thread-index: AcYH+BvnYTf0B0VySuysMkpMxRuZvQ==
| > | X-WBNR-Posting-Host: 199.45.247.98
| > | From: "=?Utf-8?B?RGF2aWQgVGhpZWxlbg==?=" <thielen@nospam.nospam>
| > | References: <062BEA43-CEB8-4C31-A031-2BB698FF2***@microsoft.com>
| > | Subject: RE: File security weirdness createing file.
| > | Date: Fri, 23 Dec 2005 11:36:02 -0800
| > | Lines: 8
| > | Message-ID: <B656DB8F-3069-40EB-A657-71F25C5BF***@microsoft.com>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | charset="Utf-8"
| > | Content-Transfer-Encoding: 7bit
| > | X-Newsreader: Microsoft CDO for Windows 2000
| > | Content-Class: urn:content-classes:message
| > | Importance: normal
| > | Priority: normal
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| > | Newsgroups: microsoft.public.dotnet.framework.aspnet
| > | NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| > | Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
| > | Xref: TK2MSFTNGXA02.phx.gbl
| > microsoft.public.dotnet.framework.aspnet:366842
| > | X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
| > |
| > | Make that "creating" file.
| > |
| > | One note - both DLLs are strongly named and code signed.
| > |
| > | Do I need to put them in the Web.Config file somewhere. Or does IIS
6.0
| > have
| > | to be told they can create files somewhere?
| > |
| > | thanks - dave
| > |
| >
| >
|