Groups | Blog | Home
all groups > dotnet security > june 2005 >

dotnet security : Running a section of code with admin privileges


JCreasy
6/28/2005 6:18:02 PM
This is rather similar to a post before titled "custom event log". What I
want to do is use EventLog.CreateEventSource() in a remote application that
will not be running admin privileges. I was hoping to find a way to
temporarily allow admin privileges just to do the log event and then resume
normal privileges.

So far I have not been very succesful in finding a way to do this and it
might be that it's just impossible for security reasons. If it is possible
Dominick Baier [DevelopMentor]
6/28/2005 8:21:54 PM
Hello JCreasy,

i would factor out that privileged code out of your main process. Package
that priv code in a NT Service or a COM+ component. Then let this code run
with admin privs and call into it from your least privileged demon.

Thats IMO the cleanest approach.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]


JCreasy
6/29/2005 6:09:02 AM
ok, so I'll take the event logging code out of the main program and package
it into a COM+ component. Run the main under my user privileges and have it
call the COM+ component.

I'm still not sure how to have the COM+ component run with admin privileges
when only the user is logged on. This is a cleaner approach, but I still have
the problem of having code run with admin privileges when only the user is
logged in.

[quoted text, click to view]
Dominick Baier [DevelopMentor]
6/30/2005 7:59:59 AM
Hello JCreasy,

in COM+ catalog under the identity tab you can configure the account the
COM+ application should run under - just choose an account with the appropriate
permissions.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]


AddThis Social Bookmark Button