Ticket #255 (new defect)
Allow current user installations to run as elevated
Reported by: | jasper | Owned by: | jasper |
---|---|---|---|
Priority: | major | Milestone: | Phase III |
Component: | Building distribution | Version: | 1.2.0.14 |
Keywords: | Cc: |
Description
Much like COM, COBIA does not like running software that was installed for the current user, in an elevated context. So with admin rights, it will not
- load COBIA from the current user installation, or
- look for PMCs that are registered for the current user
But sometimes the user is always elevated, and runs everything elevated; for example in Windows Sandbox, or on a system where the user Administrator logs in. I would argue that a current user installation for a user that did not attain the elevation through a UAC process (but always runs elevated processes) is ok. This would for example include the user Administrator on any system, if that user would have installed software for itself.
The following test code describes the issue:
bool elevated=false; bool alwaysElevated=false; // A user that manually elevated via UAC has token type TokenElevationTypeFull; an administrator does not HANDLE token; if (OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&token)) { TOKEN_ELEVATION elevation; DWORD dwSize; elevated=((GetTokenInformation(token,TokenElevation,&elevation,sizeof(elevation),&dwSize))&&(elevation.TokenIsElevated)); TOKEN_ELEVATION_TYPE type; alwaysElevated=elevated&&!((GetTokenInformation(token,TokenElevationType,&type,sizeof(type),&dwSize))&&(type==TokenElevationTypeFull)); } if (elevated) { std::cout<<"This process is Elevated\n"; } else { std::cout<<"This process is Not Elevated\n"; } if (alwaysElevated) { std::cout<<"This user always creates Elevated processes\n"; }
Here's the background on the second check:
https://devblogs.microsoft.com/oldnewthing/20241003-00/?p=110336
This code, as myself, outputs:
This process is Not Elevated
This code, when I as myself to Run As Administrator, does:
This process is Elevated
This code, run as an Administrative user that does not see the UAC prompt, does:
This process is Elevated
This user always creates Elevated processes
We should allow COBIA to load for a current user installation, in an elevated process, in case elevation was not obtained via UAC.
On a related note, COM will allow instantation of components installed for the current in a similar scenario: if the current user is inherently an administrator.