Access Denied filesystem error due to FILE_ALL_ACCESS

[ptr727]

I've been tightening up the way I use my machine, and I no longer run with the administrator account.
I ran into a problem with MakeMKV v1.7.10 on Win7 X64 SP1 getting an access denied message as soon as it tries to create the destination file.

I saw at least two similar threads on the forum, none with reasonable conclusions:
http://www.makemkv.com/forum2/viewtopic.php?f=7&t=4189
http://www.makemkv.com/forum2/viewtopic.php?f=1&t=5477

I tested:
Rip to local videos directory, under user account folder, works just fine.
Copy ripped file to network share, works just fine.
Rip to network share, fails with access denied.
Rip to local directory, with permissions set to allow read, write, change, but NOT full access, fails.

Difference between change and full control is that full control allows changing permissions.
Typically only administrators are granted full access rights, and other users get change rights, as full rights will allows anybody with such permissions to change the permissions, possibly denying other users access to the resource.

A little debugging and the problem is clear, and should be very easy to resolve.

Using process monitor I can see that MakeMKV first tests to see if the destination file exists:

Code: Select all

Date & Time:	2/16/2013 7:14:08 PM
Event Class:	File System
Operation:	CreateFile
Result:	NAME NOT FOUND
Path:	D:\Rip\MKV\FOO\title00.mkv
TID:	6980
Duration:	0.0000172
Desired Access:	Read Attributes, Synchronize
Disposition:	Open
Options:	Synchronous IO Non-Alert, Non-Directory File
Attributes:	n/a
ShareMode:	Read, Write, Delete
AllocationSize:	n/a

Then it creates the file, asking for full access:

Code: Select all

Date & Time:	2/16/2013 7:14:08 PM
Event Class:	File System
Operation:	CreateFile
Result:	SUCCESS
Path:	D:\Rip\MKV\FOO\title00.mkv
TID:	6980
Duration:	0.0130456
Desired Access:	All Access
Disposition:	OverwriteIf
Options:	Synchronous IO Non-Alert, Non-Directory File
Attributes:	N
ShareMode:	Read
AllocationSize:	0
OpenResult:	Created

This will be equivalent to calling CreateFile() with FILE_ALL_ACCESS instead of the more appropriate GENERIC_READ|GENERIC_WRITE.
Modern secure programming would use least access required patterns, I'm not pointing fingers as I don't know the code or the programmers(s), I'm just saying.

Would it be possible to fix the code to only ask for required permissions, or at least allow ripping to shares and directories with change access permissions only?

P.

[ToxicDreamz]

I'm wondering why not using the admin account is in any way tightening up security... all that does is make more permission annoyances than need be, not make your computer more secure.

[mike admin]

This will be equivalent to calling CreateFile() with FILE_ALL_ACCESS instead of the more appropriate GENERIC_READ|GENERIC_WRITE.
Modern secure programming would use least access required patterns, I'm not pointing fingers as I don't know the code or the programmers(s), I'm just saying.

Would it be possible to fix the code to only ask for required permissions, or at least allow ripping to shares and directories with change access permissions only?
P.

You are probably right, noted. But you are the first one who noticed this

[ptr727]

@Mike, thanks for taking note.