Allow write permissions to a folder for single execuatable {by path}

Question

There is an DBF-based accounting system (1C:Enterprise 7.7 with 1S-Rarus:MBTSS 2.5 configuration) running under limited user account. And this user has access to some other apps (LibreOffice for example).

Database of that accounting system is not in user profile, but only that user and administrators have access to one.

Unfortunately, some users mess up the system by accidentally accessing the files directly (for example, they find it using search). I'm wondering, maybe there is a method to limit "manual" user access to the folder at all?

What I'm thinking about is per-process permissions, which will only allow write access to the folder of accounting system for specific process, and won't let user mess it up. Something like in iOS, where only specific app can access its own files, but just for a single folder/process. I don't mind if the user still have read access to contents of that folder.

P.S. There is one method applicable for my specific case – using SQL database engine. But I'll need another version of that 1C:Enterprise for that, and price difference is just invidious.

Answer 1

Windows security is based on users; it doesn't really have a concept of applications as security principals. The easiest solution is to deny "list folder contents" on the containing folder without changing the ACL of the files in it. That way, nobody can poke around in the folder, but any program that accesses a file inside directly will be able to do so just fine.

When adding the new access control entry, it should look like this:

The important part is that the rule applies to This folder only.

When it's added, the advanced security settings window should look something like this:

Once that's done, you won't be able to navigate into the folder, but you'll find that accessing the file by path directly works. If the program needs to be able to list all the files in the folder, you can change the security on a higher-up folder instead. Search won't be able to traverse the folder you alter, but if you paste the path of a non-locked-down folder that's inside the locked folder, you'll be able to browse through it as normal.