MO changes file ownership/permissions in Profiles

[Mengmoshu]

I'm using a single MO installation to manage Skyrim mods for more than one Windows User account, (Mine and my brother's). I have separate MO Profiles for each of us to isolate saves, and to allow me to tinker with my modlist without disrupting my brother's. I have an Admin account in Windows, but my brother has a regular User account. Skyrim/Steam and MO are installed in folders that aren't usually under UAC (IE not Program Files(x86)). I'm running Windows 7 Pro x64.

Initially I couldn't properly use MO from my brother's Windows account because regular users didn't have permissions for some of the files MO wants to modify (.ini and .txt files in the active profile folder) I could start Skyrim, but there were a bunch of dialog boxes asking for admin permission on those files. I went back to my Admin account and added Full Access permission for all regular Users, which allowed me to start MO from the regular user account without any warnings or errors, and to start Skyrim.

When I returned to my Admin account and started MO I got a new permission error which prevented MO from starting and had no option to authorize access to the file. Starting MO with "run as Administrator" let me start MO without seeing the error, and MO seemed to be working fine.

Then I checked the permissions on some of the files in the various MO Profiles. This is where the problem seems to be. Nearly all of the files I looked at in the profiles have gotten a new set of permissions: SYSTEM (Full control), My Admin Account (Full control), Administrators (Full control), Users (Read & execute, Read). Previously I had set Users, Administrators, and Authenticated Users to have Full control.

MO is either changing the permissions on these files, or recreating them with new permissions. Even though I didn't make any changes to any of the profiles, or anything else for that matter, on either of the runs of MO. I generated a desktop shortcut from the regular account, and I ran Skyrim with the run executables button from the Admin account. Why would there be file side effects for those actions?

Unless there is a way for me to make sure MO created files inherit their folder permissions this is gonna put a major cramp in my plans. I don't have the available harddrive space to use another MO install for my brother (unless there's a good way to avoid duplicating the mods?).

Any help would be appreciated, and I'm happy to help investigate what's going on further if I missed something. I don't have any ongoing saves to disrupt, the profiles are identical right now so they're easy to backup, and I still have all the downloads, and good notes so I can do clean setups without too much crying.
 

[GrantSP]

You can install MO into separate user accounts and change the settings to point to a single set of downloads and mods and then each install will have separate profile folders but the same access to your downloads and mods.

 

So long as the user account with the lowest privileges doesn't have to access any tools that require Admin privileges, I think you should be good to go.

[Mengmoshu]

I'll give that a try, and I expect it to work for me.

 

But, as a user in general I'm a bit concerned about the way MO ends up interacting with Windows file permissions. Obviously not a serious issue, but it could be confusing. I'm pretty sure the only reason I recognized what was happening is that I majorly borked up some permissions on my personal user folders a few months back, so anything regarding permissions makes me look really close at what's going on. So I guess what I'm getting at, is should I post to the bug tracker about this?

[Greg]

I think Grant's answer is perhaps the best solution since neither of you will need to remember to switch profiles when playing.

 

I think the reason you are seeing this behavior is because Mod Organizer deletes and re-creates all the files in the current profile folder when it exits (even if you don't do anything other than run Mod Organizer and then close it), so the files end up inheriting the rights from the parent directory tree when they are created. It may be doing the same thing when you switch profiles, even though nothing in the profile has changed.

[Mengmoshu]

Well it's that creating and deleting I'm concerned by. Seems like a good way to corrupt a profile if the operation doesn't complete. I wouldn't be surprised if some SSD owners had concerns too.

 

Since I'm using MO's ability to start a profile from the shortcut profile switching wouldn't be too much trouble for me. Of course, it's good to mention that benefit in case someone else comes along.

 

Edit:

Also, thanks for the help. I haven't tested yet, but I expect to do that later today.

Edited September 13, 2015 by Mengmoshu

[Greg]

The deleting and creating has concerned me as well for the same reason, but I imagine this is somewhat complex to change. I keep a good backup of the Mod Organizer folder and sync it whenever I make any changes so I can easily restore if anything bad happens -- although to be honest Mod Organizer is fairly stable and reliable so it's more likely I'm tripping over my own fat fingers.

[DoubleYou]

You each need to have your own Mod Organizer install, or else you both will constantly be trampling on each other's settings regardless if you fix the permissions issue. Profiles are affected by other profiles if you modify/update/change a mod in any way. The only true solution is to make a copy for your brother. You can keep a common downloads folder, but you're just gonna be at each other's throats otherwise. Either that or you're gonna have to make some rules you can agree on and abide by them strictly (which with human nature is impossible). What you need is to buy more space, or get your brother his own computer. I'm serious. 

[Mengmoshu]

@GrantSP I got around to testing your suggestion and it works. Though I had some unrelated frustration with desktop shortcuts I'd improperly constructed.

 

@Greg I consulted with a programmer friend, and he basically said the same thing, that it might be more complex than I'm estimating to fix, or even might be there to solve something that is/was a serious problem. I'm still curious because it means I've got to deal with Windows permission settings I'd rather ignore, but it works, and I doubt it'll fail on reasonably healthy computers.

 

@DoubleYou Good advice. My brother won't be running MO proper, just using a shortcut to start Skyrim through MO, so in my case we won't be having trouble with the semi-shared setup GrantSP suggested. Though after actually checking how much space my mods were consuming it looks like completely independant MO installs will fit after all, so I'll be switching to that setup soonish, since then I don't have to worry about accidentally breaking his profile, or some sort of leakage of his in game settings. Also, I was supposed to be getting a new HDD for this laptop for my birthday, but we ordered a desktop drive by accident.

[Tannin]

Well it's that creating and deleting I'm concerned by. Seems like a good way to corrupt a profile if the operation doesn't complete. I wouldn't be surprised if some SSD owners had concerns too.

On the contrary, creating the files clean is a a good way to keep your profile healthy.

The thing is: On a code level you can't insert into a file, you can only overwrite bytes already in the file so unless you're only appending to a file (i.e. you add to a log file) you have to truncate the file and write all the content fresh anyway.

Now if you truncate the existing file and write it and then something goes wrong you're screwed.

If however you create a new file with a different name, write to that and if successful you delete the old file and reename the new file to the right name then you can't have data loss. Renaming a file practically never fails. So with this scheme you always have either the working old file or the working new file but never a broken in-between.

And the concerns of SSD owners are misguided, MO could write its ini files in a constant loop and you could still run it for 10 years straight without seeing lost blocks on your ssd. The worry of SSD owners is pure hysteria of people incapable of math.

 

Now regarding file permissions: MO does NOT set the file permissions of files, it simply creates the files and has windows give the file default file permissions. The new file will then simply inherit its permissions from the parent folder.

Your actual problem is, and really this is the number 1 reason for MO problems: You're using an administrator account to run MO sometimes and regular account other times.

The fix: Don't use an administrator account to run MO.

Actually: Never use an administrator account to run software period. The administrator account is there to install software and configure the machine and that's it.

Use a regular user account like your brother, give ownership of the MO folder to the users group and you shouldn't have permissions problems ever again.

[Mengmoshu]

Thanks for clarifying.
 
I hadn't thought of the possibility of keeping the old file and then renaming the new one. Though I did know about the usual limitations of altering files. Sorry if I sounded like one of the SSD paranoids, I already know that you've gotta be writing a lot of data even on the older SSDs for them to "wear out."
 
My answer about the admin account is that I'm lazy, and I spent too many years using older versions of Windows where User accounts were nearly useless for gamers. Your advice is good, and I'll keep that in mind next time I'm rejigging accounts on my machine. I'm still learning how to deal with permissions, ownership, and UAC. Also, I hadn't thought of giving ownership to a whole user group which is something I'm going to have to keep in mind going forward.
 
So the only question I have left, and this is pure curiousity: What does MO do with the profiles that changes some of their files when you just open and then close MO?
 
Again, thanks. It's nice to have detailed information out there for people like me who do things wrong, or ask the wrong questions.