How to restrict applications access to files in Windows?

Question

css

There is a desire in Windows to restrict the access of individual applications to files.
As I imagine it in the minimum version:
- there is a list in which for each exe-file it is written, the files in which directories are available to it for reading and in which for writing;
- there is a driver (?) that intercepts "open file" WinAPI calls, checks against the list and, if the directory is not available, returns an "access denied" error code.

I am sure that there should be ready-made software for this task. Please advise.

Answer 1

I won't help with the lines, but with the "Sun"... https://ru.stackoverflow.com/questions/716975/%D0%...

Answer 2

If you don't want to bother, don't touch it at all.
Blocks on absolutes, build by position in each size. I would do so.

Answer 3

Read about APPLocker or Controlled folder access in WIndows Defender - maybe
this is what you need.

Answer 4

https://staffcounter.net/ru/dlp/
is able to restrict access for given ##.exe to paths by mask. for example, it can prevent the browser or skype from opening files outside its profile folder - i.e. the user will not be able to attach the file, send it to the cloud. disk or send via skype.

Answer 5

Your protection will be bypassed by calling some programs by others.

Answer 6

There is an ACL at the NTFS level, assign special access permissions to a specific group.
No drivers are needed, everything is decided at the OS level.
Another good practice is to assign a list of allowed applications to run through group policy and assign them as a shell, for example, a 1C client or AWP (Workstation)
Describe your task, not your vision, how this can be implemented

Answer 7

Do you need tamper protection software?