Prohibiting Container Deletion When Deletion of its Parent Container Contents Is Disabled
The following two security rules set different sets of access rights for
a parent object (in this example, the httpdocs
folder on domain
example.com
) and its child objects - subfolders and files contained
in the folder. The resulting security configuration will prohibit
deletion of the parent container by a domain user but will allow the
user full control for files and folders contained in the httpdocs
folder.
Security rule entry 1
The following rule sets access rights to files in the httpdocs
folder on domain example.com
for the Windows user account named
domainuser1
, prohibiting deletion of the folder.
<Entry AccounType="1" Account="domainuser1" SidStr="S-1-5-21-2767697126-2621801917-3613110436-1022" Path="[HTTPD_VHOSTS_D]" SubPath="example.com\httpdocs" AceFlags="ThisObjectOnly" AccessMask="FileNonRemovable" EntryFlags="0x140" Tag="DomainUser" Tag2="" /
Explanation
Because the name domainuser1 is not a standard system account name, it
has to be resolved in the system (hence, AccounType=”1”). The optional
SidStr attribute is defined to improve Plesk stability. The
HTTPD_VHOSTS_D component path in the Path attribute specifies the common
part of the path to the domain root folder where the example.com folder
is located. The SubPath attribute completes the path to the httpdocs
folder to which the rule will be applied. AceFlags=”ThisObjectOnly”
specifies that, according to this rule, an ACE with permission defined
by AccessMask=”FileNonRemovable” will be created and added only to the
httpdocs folder on domain example.com. EntryFlags=”0x140” enables (i)
creation of the folder (which is necessary during domain creation), (ii)
strict enforcement of the access permissions defined by the
AccessMask= "FileNonRemovable"
permission mask, and (iii) sets the
ACE type to Allow Access. Tag=”DomainUser” designates the security rule
as pertaining to a domain hosting account and is used by Plesk to
properly organize the processing of security metadata.
Security rule entry 2
The rule sets full control rights to the httpdocs
folder, its
subfolders and files on domain example.com
for the Windows user
account named domainuser1
.
<Entry AccounType="1" Account="domainuser1" SidStr="S-1-5-21-2767697126-2621801917-3613110436-1022" Path="[HTTPD_VHOSTS_D]" SubPath="example.com\httpdocs" AceFlags="SubfoldersAndFilesOnly" AccessMask="FullAccess" EntryFlags="0x140" Tag="DomainUser" Tag2="" />
Explanation
Because the name domainuser1
is not a standard system account name,
it has to be resolved in the system (hence, AccounType="1"
). The
optional SidStr
attribute is defined to improve Plesk stability. The
HTTPD_VHOSTS_D
component path in the Path
attribute specifies
the common part of the path to the domain root folder where the
example.com
folder is located. The SubPath
attribute completes
the path to the httpdocs
folder to which the rule will be applied.
AceFlags="SubfoldersAndFilesOnly"
specifies that, according to this
rule, an ACE with permission defined by AccessMask="FullAccess"
will
be created and added to the httpdocs
folder and all of its
subfolders and files on domain example.com
. EntryFlags="0x140"
enables (i) creation of the folder (which is necessary during domain
creation) and (ii) strict enforcement of the access permissions defined
by the AccessMask="FullAccess"
permission mask. Tag="DomainUser"
designates the security rule as pertaining to a domain hosting account
and is used by Plesk to properly organize the processing of security
metadata.