C# Linq for files user has read access to

Question

How would I use Linq on list.Items = directoryInfo.GetFiles("\\server\share\folder\"); to include only the files the user has read access to?

... So far only suggestions are using try/catches, or APIs that are obsolete in .NET 4.0? I'd prefer something to read the ACL's and see if the specific user or a group the user is a member of has been granted read access. I'm trying to do this for simplified management of granting reports to users on a website that won't be high traffic, so the logic that "who knows if you can actually read it when you try to open the file" doesn't pertain to this case. I sense that Microsoft should really make this task easier.

Ashley John · Answer 1 · 2011-09-22T03:58:27.830

1

just try this out .should work .haven't tested though

  var fw = from f in new DirectoryInfo("C:\\Users\\User\\Downloads\\").GetFiles()
                where SecurityManager.IsGranted(new FileIOPermission
 (FileIOPermissionAccess.Write, f.FullName))
                select f;

EDIT if it is just read only files then try this

var fe = from f in new DirectoryInfo("C:\\Users\\ashley\\Downloads\\").GetFiles()
                where f.IsReadOnly==true
                select f

edited Sep 22 '11 at 03:58

answered Sep 22 '11 at 03:24

Ashley John

2,379
2
21
36

You might be able to [use the solution from this question instead](http://stackoverflow.com/questions/2978612/how-to-check-if-a-windows-file-is-readable-writable). – Merlyn Morgan-Graham Sep 22 '11 at 04:02
yeah ..but stating some logic inside catch doesn't sound very elegent.Imagine you have thousands of files and waiting for exception to occure to get its state is pretty expensive operation.. – Ashley John Sep 22 '11 at 04:06
@Ashley: Those try/catch I'm pretty sure are special cases (a drive doesn't exist, or you are completely locked out of a folder). You can call that function from within a Linq query, so your higher level code can still be pretty. It already encapsulates the true/false, so you'd just need to plug it into a `where` clause. I don't know if there is a better option without using p/Invoke (e.g. a `Try` variant). Also I think enumerating the files on the filesystem might be a bottleneck already. I speculate the exception will be negligible at that point. – Merlyn Morgan-Graham Sep 22 '11 at 04:25

score 1 · Answer 2 · edited May 23 '17 at 12:22

1

You run the risk of a race condition if you check for read permission prior to opening the file.

If you're attempting to read all of the files you have access to in a folder, better to just try opening each one and catch the UnauthorizedAccessException.

See:

edited May 23 '17 at 12:22

Community

1
1

answered Sep 22 '11 at 03:32

Michael Petito

12,891
4
40
54

score 0 · Answer 3 · answered Sep 22 '11 at 03:21

Note: I haven't tested it, but in theory it should work

First, define a predicate to determine read access

bool CanRead(FileInfo file)
{
  try {
    file.GetAccessControl();
    //Read and write access;
    return true;
  }
  catch (UnauthorizedAccessException uae)
  {
    if (uae.Message.Contains("read-only"))
    {
      //read-only access
      return true;
    }
    return false;
  }
}

Then, it should be a simple case of using a where clause in a linq query

from file in directoryInfo.GetFiles("\\server\share\folder\") 
  where HaveAccess(f) == true
    select f;

score 0 · Answer 4 · edited Jun 21 '15 at 13:51

Tested and working, but will return false if the file is in use

void Main()
{
    var directoryInfo = new DirectoryInfo(@"C:\");
    var currentUser = WindowsIdentity.GetCurrent();
    var files = directoryInfo.GetFiles(".").Where(f => CanRead(currentUser, f.FullName));
}

private bool CanRead(WindowsIdentity user, string filePath)
{
    if(!File.Exists(filePath))
        return false;

    try
    {
        var fileSecurity = File.GetAccessControl(filePath, AccessControlSections.Access); 
        foreach(FileSystemAccessRule fsRule in fileSecurity.GetAccessRules(true, true, typeof(System.Security.Principal.SecurityIdentifier)))
        {
            foreach(var usrGroup in user.Groups)
            {
                if(fsRule.IdentityReference.Value == usrGroup.Value)
                    return true;
            }
        }
    } catch (InvalidOperationException) {
        //File is in use
        return false;
    }

    return false;
}

Does this work for groups within groups? How about explicit deny permissions? — Michael Petito, Sep 22 '11 at 03:38

C# Linq for files user has read access to

4 Answers4