The first releases of Citrix Application Streaming had isolation on the brain.  If you don’t know what else to do, ISOLATE!  Don’t let the app hit anything that might be important.  If you don’t know if it’s important or not, then it’s important!  Protect it!

This over protective behavior is being relaxed, the first step was in the XenApp XenApp 5.0 (Delaware) release where streaming client 1.2 was released which changed file system isolation to auto-ignore non-boot disk drives and soon, in the XenApp 5 Feature Pack 2 release where the version 5.2 streaming profiler and client change the default file system rule from “isolate” to “ignore”.

Isolation rules review

When a user stores documents to disk under Application Streaming, the isolation system inspects the file operation to decide whether that operation should be isolated, ignored or redirected.  Details on each of these can be found here in the Citrix documentation library and here in my previous blogs.  All rules are named from the perspective of the streaming system, so “ignore” means don’t change it – let it go to the file system without modification.

What isn’t obvious, is what the isolation system does with disk volumes beyond the boot volume.  This behavior changed in streaming profiler version 1.2 (XenApp Delaware) so that the over paranoid behavior of the original Tarpon technology would instead leave users data alone.  Notice that I’m assuming users put data on drive D: while the OS is on drive C:.  This change has been beneficial to most customers and really helps engage the desktop, though I have seen a few that needed this to not occur and this oversight will soon be corrected to be backwardly consistent – for profiles created at the 1.1 level.

To be clear, space beneath the user profile is and always has been “ignored”, which means the normal places for users to store documents have no isolation collisions.  It’s the non-normal places that require attention.

In App Streaming 5.2 which isn’t out yet, the isolation will be further relaxed.

In addition to ignoring non-boot disk volumes, the isolation system will change it’s default rule from “isolate” to “ignore”.  Notice that this will happen only for NEW profiles.  If you have existing profiles, their behavior is already defined.

Example user of Citrix showcase internal farm

Consider an example user, we will call him “Nabeel”, because – well, that is his real name.  Nabeel is a Citrix executive and he travels a lot.  When he travels, he does lots of presentations and … uses Citrix Application Streaming to run MS Office 2007.

In the example case, he was on a 3 week trip to Asia where he visited lots of Citrix sites and lots of customers.  With the magic of Application Streaming, he was able to use MS PowerPoint “offline” on the airplane to refine his presentations and also update the PPTs throughout the journey.  All of this worked super!

Presentations updated all over the world, presented all over the world.  Everything was well received, and then he came home….

When he returned to Fort Lauderdale, he used Windows explorer to zip up all the files from the 3 weeks of presentations and e-mailed them out to the people he had met.  The receiving people noted that the presentations were mere skeletons.  CONTENT FREE if you will.  Everything worked on for many weeks was “as it was” 5 weeks earlier before he put Application Streaming onto the notebook.  OOOPS!

My phone rings…

What happened?  Answer: the files were all stored to the \Citrix2007 directory and since this is not a space that is “known safe”, the isolation system isolated it.  From the view of the powerpoint application under isolation, it saw the correct and current version of the document.  But look at the real disk and the files were their original selves.   BAD.

Step 1: Where did the good files go?

That one is easy:

Consider the layers of glass.  The answer is that the file is in the top layer of the layers of isolation.  Find it in  %APPDATA%\Citrix\RadeCache\GUID\Device\C\Citrix2007

Step 2: How to make this not happen again…

Harder.  Insufficient answer is to add an ignore rule for Citrix2007 to the profile.  No good.

Not a problem for stream to server

Before going deeper, it should be said that this problem never comes up for stream to server.  In a server environment, “users” do not have the power to create directories off of the ROOT.  Users can store documents to %USERPROFILE% and that’s about it.  Server side, this problem doesn’t exist.

Stream to desktop

Client side, “users” tend to be “administrators” and this creates new problems.  “Users” like storing stuff to folders off of the root.  This makes it really easy to know what you need to backup.

The isolation system not knowing how to handle the \Citrix2007 directory isolated the operations and this is far too over protective.

App Streaming 5.2 (Yellowtail)

In the upcoming release, the default file system rule for new profiles is changed from “isolate” to “ignore”.  The default rule set then includes \Windows, \Program files and similar “important” directories as places that should be isolated at runtime.  I’ll add that the profiling time rules and the execution time rules have to vary a bit to make this occur.  The streaming system takes care of this automatically.  Profiling time remains paranoid by default, isolating most everything.  Runtime becomes much more relaxed – making the isolated application execution more consistent in behavior with locally installed, while maintaining “protection” of spaces that the application should not be allowed to write per the layers of glass.

File system permissions still apply

If the user tries to write to a space that they aren’t allowed, the file system permissions remain in place.  A user will only be able to write to or read from the real \Citrix2007 if they have DACLs in place that make this permissible.  This is a file system statement, not a isolation system.  In the “ignore” case, what happens is that the isolation system sends the I/O operation down to the file system without change and the file system will then decide if the user is allowed to access those files.

This change greatly improves the offline streaming experience.

Joe Nord – Citrix Systems Product Architect – Application Streaming

Learn more about Citrix XenApp 5 Feature Pack 2

Follow XenApp on | | |