MediaPortal Forum - View Single Post - Allow MediaPortal to run as a non-Administrator users (without granting Permissions)

palswim · 2007-12-06, 22:36

Started on: 2007-12-06
last update: 2007-12-06

Summary:
MediaPortal requires Full Control on a least some of the files and folders in the installation directory. Instead, use the User Profiles (and "All Users" profile) to store data.

Area:
MediaPortal installation/configuration/administration

Description:
On my Media PC, I have created a limited (non-Administrator) user to use MediaPortal and play media. Basically, the user has this and only this function to perform. The user has access to all of the files he would need to play if he used Windows Explorer to play the media.

But MediaPortal uses its installation directory to store data. It took a while for me to figure out why I kept receiving warnings and errors while using it. But finally, I gave my user "Full Control" privileges in the MediaPortal directory and then MediaPortal worked like a charm. The problem is: I don't want my user to have full control anywhere in the "Program Files" directories. But in addition to purity in permissions, I don't want to user to have the ability to delete the MediaPortal software, which he will have with Full Control. So, whoever wants to use my Media Center (roommates, etc.), knowingly or unknowingly can delete the MediaPortal software.

Another approach I tried involved figuring out exactly which files MediaPortal wants to change during normal operation. I gave my user full control on the "logs" directory and some of the XML configuration files. But when I installed an update to MediaPortal, it again gave me errors and the like, meaning it either re-set the permissions or added new files to which it needs access. So, I also don't want to hunt down on which files I need to set permissions.

The improvement I would love to see would distinguish three types of options: Global, Default, and User. Global options would apply to every instance of MediaPortal with any user (Administrator or not) would run. MediaPortal would read the Global options from the "All Users" profile. Default options also would reside in the "All Users" profile, and any option that a specific user has not set would come from the Default option value. User options would exist in the specific user's profile and would only apply to MediaPortal instances which the specific user runs. (Also, MediaPortal would probably keep logs in the user profile as well.)

We could further separate the options into Local (system-specific) and Roaming (Windows Vista uses these terms; XP uses "%USERPROFILE%\Application Data\" for Roaming and "%USERPROFILE%\Local Settings\Application Data\" for Local), but I don't know if we need to do that. Regardless, Windows has decent-to-use APIs for determining all of these directories.

As far as how a user would configure these options, I haven't completely thought this through. Perhaps, we could keep the "Configuration.exe" from the MediaPortal installation directory and have that configure the Global and Default options. Only a user who has write access to the "All Users" profile (access to the MediaPortal data directory, at least) could use this application (other users receive an error if they try to run it). Then, we could have another executable (or a switch to pass into "Configuration.exe" - "-user [username]" perhaps, and default to current user if the user omits the "[username]"). This application would only change User options.

All this implementation suggesting runs secondary to the core issue, which is: Non-Administrators should have the ability to run MediaPortal without special permissions.

Regardless, MediaPortal has served my needs very well and I really appreciate the product. I know how development on free software goes, and if I happen upon some free time, I will try to contribute some code. Keep up the good work guys!

2007-12-06, 22:36	#1 (permalink)
palswim Portal User Join Date: Dec 2007 Posts: 4 Thanks: 0 Thanked 0 Times in 0 Posts	Allow MediaPortal to run as a non-Administrator users (without granting Permissions) Started on: 2007-12-06 last update: 2007-12-06 Summary: MediaPortal requires Full Control on a least some of the files and folders in the installation directory. Instead, use the User Profiles (and "All Users" profile) to store data. Area: MediaPortal installation/configuration/administration Description: On my Media PC, I have created a limited (non-Administrator) user to use MediaPortal and play media. Basically, the user has this and only this function to perform. The user has access to all of the files he would need to play if he used Windows Explorer to play the media. But MediaPortal uses its installation directory to store data. It took a while for me to figure out why I kept receiving warnings and errors while using it. But finally, I gave my user "Full Control" privileges in the MediaPortal directory and then MediaPortal worked like a charm. The problem is: I don't want my user to have full control anywhere in the "Program Files" directories. But in addition to purity in permissions, I don't want to user to have the ability to delete the MediaPortal software, which he will have with Full Control. So, whoever wants to use my Media Center (roommates, etc.), knowingly or unknowingly can delete the MediaPortal software. Another approach I tried involved figuring out exactly which files MediaPortal wants to change during normal operation. I gave my user full control on the "logs" directory and some of the XML configuration files. But when I installed an update to MediaPortal, it again gave me errors and the like, meaning it either re-set the permissions or added new files to which it needs access. So, I also don't want to hunt down on which files I need to set permissions. The improvement I would love to see would distinguish three types of options: Global, Default, and User. Global options would apply to every instance of MediaPortal with any user (Administrator or not) would run. MediaPortal would read the Global options from the "All Users" profile. Default options also would reside in the "All Users" profile, and any option that a specific user has not set would come from the Default option value. User options would exist in the specific user's profile and would only apply to MediaPortal instances which the specific user runs. (Also, MediaPortal would probably keep logs in the user profile as well.) We could further separate the options into Local (system-specific) and Roaming (Windows Vista uses these terms; XP uses "%USERPROFILE%\Application Data\" for Roaming and "%USERPROFILE%\Local Settings\Application Data\" for Local), but I don't know if we need to do that. Regardless, Windows has decent-to-use APIs for determining all of these directories. As far as how a user would configure these options, I haven't completely thought this through. Perhaps, we could keep the "Configuration.exe" from the MediaPortal installation directory and have that configure the Global and Default options. Only a user who has write access to the "All Users" profile (access to the MediaPortal data directory, at least) could use this application (other users receive an error if they try to run it). Then, we could have another executable (or a switch to pass into "Configuration.exe" - "-user [username]" perhaps, and default to current user if the user omits the "[username]"). This application would only change User options. All this implementation suggesting runs secondary to the core issue, which is: Non-Administrators should have the ability to run MediaPortal without special permissions. Regardless, MediaPortal has served my needs very well and I really appreciate the product. I know how development on free software goes, and if I happen upon some free time, I will try to contribute some code. Keep up the good work guys!