I have created a new MediumLow integrity level for my web browser. So, for its playground, I created %userprofile%\AppData\LocalML. Since %userprofile%\AppData\LocalLow is the only example I am aware of a playground for low integrity applications, I cloned my new folder like LocalLow (except for the integrity level).
The permissions on Windows 7 Professional SP1-64bit for LocalLow look like this.
C:\Users\TheUser\AppData>icacls locallowlocallow NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) Default4\TheUser:(OI)(CI)(F) Mandatory Label\Low Mandatory Level:(OI)(CI)(NW) C:\Users\TheUser\AppData>dir /q Directory of C:\Users\TheUser\AppData 12/27/2013 12:44 AM <DIR> Default4\TheUser Local12/15/2013 01:32 AM <DIR> NT AUTHORITY\SYSTEM LocalLow12/31/2013 08:22 PM <DIR> NT AUTHORITY\SYSTEM LocalML01/25/2014 05:09 PM <DIR> Default4\TheUser RoamingOk, fine and dandy, the owner is SYSTEM and so I made my new LocalML the same way.
So, when I read on the Palemoon website that there was a browser build optimized for Atom processors, I decided to load it on my netbook, running Windows 7 Starter, now upgraded to SP1, but originally just Windows 7. And I set upon to build a MediumLow integrity level folder for it, since I don't like browsers running in medium integrity.
It didn't occur to me that LocalLow on the starter is configured somewhat differently. So, I built my localML like I did on Win7-pro and when I compared it to the LocalLow, I saw differences. So I checked LocalLow on the starter and see:
C:\Users\TheUser3\AppData>icacls locallowLocalLow NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F) BUILTIN\Administrators:(I)(OI)(CI)(F) DEFAULT8\TheUser3:(I)(OI)(CI)(F) Mandatory Label\Low Mandatory Level:(OI)(CI)(NW) C:\Users\TheUser3\AppData>dir /Q Directory of C:\Users\TheUser3\AppData 01/31/2014 07:38 PM <DIR> DEFAULT8\TheUser3 Local07/25/2009 01:46 AM <DIR> DEFAULT8\TheUser3 LocalLow12/17/2010 07:39 PM <DIR> DEFAULT8\TheUser3 RoamingOn Win 7 professional, LocalLow is owned by System, and there are no inherited permissions. On Win 7 starter, LocalLow is owned by the user, and there are inherited permissions, except for the integrity level. I have never monkeyed around with the permissions on folders that existed when I got the computers.
What I don't understand is why there would be a difference in the setup of LocalLow between starter and professional. Anyone know why there is a difference?
↧