RE: Elevate permission of code

Hi Zinon,

As for the privilege elevation, I'm afraid you're limited to the Vista
interactive elevation behavior since the UAC is used to detect any
privileged operations that may occcur in application's code. If it is
allowed to programmatically elevate privilege, then the security hole is
opened again.

So far for applications that may require admin token(elevated privilege),
there are two means:

1. Just let the UAC detect it and request the user to do the elevation
on-demand when executing.

2. Add a manifest for your application and tell what level of execution
permission will it require. Thus, the operating system will demand that
elevation(if necessary) at startup time.

#How To: Tell Vista's UAC What Privelege Level Your App Requires
http://channel9.msdn.com/Showpost.aspx?postid=211271

http://blogs.msdn.com/shawnfa/archive/2006/04/06/568563.aspx

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
From: =?Utf-8?B?Wmlub24=?= <zinon@xxxxxxxxxxxxxxxx>
Subject: Elevate permission of code
Date: Wed, 20 Feb 2008 08:21:01 -0800


Hi All,

I have an application which accesses and modifies the registry during
runtime. The application is being deployed using ClickOnce. However, the
users running the application do not have the required privileges to
modify
the registry and the application fails.

Is there a way to elevate the security priveleges of a particular piece of
code in order to modify the registry or carry out other tasks which may
have
security restrictions?

I've tried declaring [RegistryPermission(SecurityAction.Assert,
Unrestricted
= true)] on the calling class, as well as:
RegistryPermission permission = new
RegistryPermission(PermissionState.Unrestricted);
permission.Assert();
..in the method body but with no luck so far. What am I not doing? Or
maybe,
what should I be doing?

Thanks
Zinon


.

Relevant Pages

  • RE: Elevate permission of code
    ... As for the privilege elevation, I'm afraid you're limited to the Vista ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)
  • RE: Elevate permission of code
    ... As for the privilege elevation, I'm afraid you're limited to the Vista ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.platformsdk.security)
  • RE: How to proper use sendinput to a elevated window from a servic
    ... So your task is helping the end user to dismiss the UAC ... dialog programmatically so that the elevation can be automatically, ... Microsoft introduced this to prevent the shatter attack. ... Microsoft Online Community Support ...
    (microsoft.public.platformsdk.security)
  • Re: Vista/7 permissions for script?
    ... familiar with UAC and elevation. ... entirely clear about the result of turning off UAC. ... If you turn off UAC, you have essentially the same behavior as you do in XP/2000/2003, where if your account has administrative privileges, applications can make system modifications without you being aware of it. ... Here's the behavior you get for the administrator account, accounts that are members of the administrators group, and normal users. ...
    (microsoft.public.scripting.vbscript)
  • The Weakness of Windows Impersonation Model
    ... The Weakness of Windows Impersonation Model ... Network Service account’s context is elevated to LocalSystem. ... unauthorized privilege elevation. ...
    (Bugtraq)