Ticket #255 (new defect)

Opened 6 days ago

Last modified 6 days ago

Allow current user installations to run as elevated

Reported by: jasper Owned by: jasper
Priority: major Milestone: Phase III
Component: Building distribution Version: 1.2.0.14
Keywords: Cc:

Description

Much like COM, COBIA does not like running software that was installed for the current user, in an elevated context. So with admin rights, it will not

  • load COBIA from the current user installation, or
  • look for PMCs that are registered for the current user

But sometimes the user is always elevated, and runs everything elevated; for example in Windows Sandbox, or on a system where the user Administrator logs in. I would argue that a current user installation for a user that did not attain the elevation through a UAC process (but always runs elevated processes) is ok. This would for example include the user Administrator on any system, if that user would have installed software for itself.

The following test code describes the issue:

    bool elevated=false;
    bool alwaysElevated=false; // A user that manually elevated via UAC has token type TokenElevationTypeFull; an administrator does not

    HANDLE token;
    if (OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&token)) {
        TOKEN_ELEVATION elevation;
        DWORD dwSize;
elevated=((GetTokenInformation(token,TokenElevation,&elevation,sizeof(elevation),&dwSize))&&(elevation.TokenIsElevated));
        TOKEN_ELEVATION_TYPE type;
alwaysElevated=elevated&&!((GetTokenInformation(token,TokenElevationType,&type,sizeof(type),&dwSize))&&(type==TokenElevationTypeFull));
    }
    if (elevated) {
        std::cout<<"This process is Elevated\n";
    } else {
        std::cout<<"This process is Not Elevated\n";
    }
    if (alwaysElevated) {
        std::cout<<"This user always creates Elevated processes\n";
    }

Here's the background on the second check:

https://devblogs.microsoft.com/oldnewthing/20241003-00/?p=110336

This code, as myself, outputs:

This process is Not Elevated

This code, when I as myself to Run As Administrator, does:

This process is Elevated

This code, run as an Administrative user that does not see the UAC prompt, does:

This process is Elevated
This user always creates Elevated processes

We should allow COBIA to load for a current user installation, in an elevated process, in case elevation was not obtained via UAC.

Change History

comment:1 Changed 6 days ago by jasper

On a related note, COM will allow instantation of components installed for the current in a similar scenario: if the current user is inherently an administrator.

Note: See TracTickets for help on using tickets.