Which permissions are required to enable process.start via asp.net application?

Question

I have an asp.net application which uses process.start to call an executable (Graphviz). All works well in my development environment, but when I move to production I'm not able to get the process to run. Here's the details.

I created this simple sub to show the issue.

    Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load

    Dim ProcessInfo As ProcessStartInfo
    ProcessInfo = New ProcessStartInfo

    'ProcessInfo.Domain = "xxxxxxx"
    ProcessInfo.UserName = "xxxxxx"
    Dim PwdString As String = "xxxxxxx"
    Dim newPass As System.Security.SecureString
    newPass = New System.Security.SecureString
    For Each c As Char In PwdString
        newPass.AppendChar(c)
    Next c
    ProcessInfo.Password = newPass

    'ProcessInfo.FileName = """C:\Windows\System32\Notepad.exe"""
    'ProcessInfo.FileName = """C:\Test.bat"""
    ProcessInfo.FileName = """C:\Program Files (x86)\Graphviz2.30\bin\dot.exe"""
    ProcessInfo.Arguments = " -Kdot -Tsvg C:\Test.dot -pC:\Test.svg"
    ProcessInfo.RedirectStandardOutput = True
    ProcessInfo.UseShellExecute = False
    ProcessInfo.CreateNoWindow = True

    Dim Process As Process
    Process = New Process
    Process.StartInfo = ProcessInfo
    Process.Start()

    'Wait until the process passes back an exit code 
    Process.WaitForExit()

    Try
        Dim ProcessResults As String = Process.StandardOutput.ReadToEnd
        Output.Text = ProcessResults
    Catch ex As Exception
        Output.Text = ex.ToString
    End Try

End Sub

There are three scenarios here. First, I am testing simply starting notepad. - Development works - Production works (This is the only case that I could get to work in production)

Second I created a simple batch file that opens a doc in notepad. (notepad c:\test.dot)

Development works
Production does not work

Third, I have am calling Graphviz's dot.exe. This is what I am trying to get to work in another page.

Development works
Production does not work

In all of the cases where production does not work I can reproduce this behavior - If I add an impersonate = true to my web.config, then I do not get any errors back. The page runs as if it was successful.

If I don't add an impersonate config, but do add the credentials to the ProcessInfo object, then the page will again run without error. The process is not started in production, though.
If I do not add the impersonate or ProcessInfo credentials, then I will get an error. This is the error output.

Access is denied

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ComponentModel.Win32Exception: Access is
denied

Source Error:    
Line 36:         Process = New Process
Line 37:         Process.StartInfo = ProcessInfo
Line 38:         Process.Start()
Line 39:
Line 40:         'Wait until the process passes back an exit code

Source File:  C:\Inetpub\vhosts\leapfrogbi.com\httpdocs\test\ProcessStart.aspx.vb Line:  38 

Stack Trace:    
[Win32Exception (0x80004005): Access is denied]   
System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) +2161
System.Diagnostics.Process.Start() +150   
Test_ProcessStart.Page_Load(Object sender, EventArgs e) in C:\Inetpub\vhosts\leapfrogbi.com\httpdocs\test\ProcessStart.aspx.vb:38
System.Web.UI.Control.OnLoad(EventArgs e) +91   
System.Web.UI.Control.LoadRecursive() +74   
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2207

I have tried a variety of security related settings. Currently my app pool is running with an identity that is a local administrator. I have also tried adding everyone to the administrators group in an attempt to see if security was the root problem.

Also, I am using Plesk to manage my domain. I have searched extensively for any options that might be affecting this situation, and have found not yet. Again, process start does work in production when making a simple call to start notepad. It is very hard to narrow this down without more verbose logs.

Thank you in advance for any help you can offer. This is driving me nuts.

score 3 · Accepted Answer · edited May 23 '17 at 12:33

3

Locate your pool under which your site is run, and see under which user is running.

If you can't do that you can run this code to see the user that your pool is running:

var user = System.Security.Principal.WindowsIdentity.GetCurrent().User;
var userName = user.Translate(typeof(System.Security.Principal.NTAccount));

And then give permission to that user to be able to run these files.

reference: How to find out which account my ASP.NET code is running under?

edited May 23 '17 at 12:33

Community

1
1

answered Feb 21 '13 at 10:54

Aristos

66,005
16
114
150

Thank you, Aristos. I did as you suggest, but the app pool identity is currently part of the local administrators group. – DataMe Feb 21 '13 at 17:16
I verified that this is the same user returned by Security.Windowsidentity.GetCurrent.User. I also went ahead and explicitly gave the same user permission to the files & involved with the request, but have the same result. Keep in mind that I can run the application using a admin account, but the process does nt actually run with the exception of the first example where notepad is started. – DataMe Feb 21 '13 at 17:42
Cancel my last. I found a file that the user did not have permission to. The batch file ran. I will further test with the target exe & report back. – DataMe Feb 21 '13 at 17:51
2

Update - I was able to get the target exe to run. Thank you, Aristos for pointing me in the right direction. The solution was simply to ensure that the app pool identity has rights to the executable and all files involved. In my case I assumed that this was in place since my app pool identity was part of the administrtors group, but the file system permissions were set by Plesk which excluded the files involved. – DataMe Feb 21 '13 at 19:18
@DataMe I am glad that you get help and final find it. – Aristos Feb 21 '13 at 20:10
1

My webapp was running under **ApplicationPoolIdentity**, I gave permission to **IIS_IUSRS** on folder containing .exe, and then it ran successfully. – Himalaya Garg Mar 11 '20 at 16:45

score 0 · Answer 2 · answered Jan 20 '17 at 03:04

I am not use process, use shell and it is running successful.

Create a batch file that include your command. Don't save the batch in system folder.
In IIS, open setting dialog of the application pool that your web site running on. Set the ID of process pool as "localsystem".
Use shell("path\batchfile") to execute the batch file.

Which permissions are required to enable process.start via asp.net application?

2 Answers2

Linked