In Unix, "others" class refers to all users except the owner of the file and the members of the group assigned to this file.

In Windows, "Everyone" group is similar and includes all members of the Authenticated Users group as well as the built-in Guest account, and several other built-in security accounts.

Granting permissions to these groups can lead to unintended access to files.

Ask Yourself Whether

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

The most restrictive possible permissions should be assigned to files and directories.

Sensitive Code Example

.Net Framework:

var accessRule = new FileSystemAccessRule(
    "Everyone",
    FileSystemRights.FullControl,
    AccessControlType.Allow);

var fileSecurity = File.GetAccessControl("path");
fileSecurity.AddAccessRule(accessRule); // Sensitive
File.SetAccessControl("fileName", fileSecurity);

.Net / .Net Core

var accessRule = new FileSystemAccessRule("Everyone", FileSystemRights.Write, AccessControlType.Allow);
var fileInfo = new FileInfo("path");
var fileSecurity = fileInfo.GetAccessControl();

fileSecurity.SetAccessRule(accessRule); // Sensitive
fileInfo.SetAccessControl(fileSecurity);

.Net / .Net Core using Mono.Posix.NETStandard

var fsEntry = UnixFileSystemInfo.GetFileSystemEntry("path");
fsEntry.FileAccessPermissions = FileAccessPermissions.OtherReadWriteExecute; // Sensitive

Compliant Solution

.Net Framework

var accessRule = new FileSystemAccessRule(
    "Everyone",
    FileSystemRights.FullControl,
    AccessControlType.Deny);

var fileSecurity = File.GetAccessControl("path");
fileSecurity.AddAccessRule(safeAccessRule);
File.SetAccessControl("path", fileSecurity);

.Net / .Net Core

var accessRule = new FileSystemAccessRule("Everyone", FileSystemRights.FullControl, AccessControlType.Deny);
var fileInfo = new FileInfo("path");
var fileSecurity = fileInfo.GetAccessControl();

fileSecurity.SetAccessRule(accessRule);
fileInfo.SetAccessControl(fileSecurity);

.Net / .Net Core using Mono.Posix.NETStandard

var fsEntry = UnixFileSystemInfo.GetFileSystemEntry("path");
fsEntry.FileAccessPermissions = FileAccessPermissions.UserExecute;

See