Windows: Avoid launching as admin when NSIS installer ends. #12985

JeremyRand · 2018-04-14T13:36:07Z

The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This PR works around the issue by having explorer.exe launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin.

I've tested this with Sysinternals Process Explorer on Windows 10 32-bit. I wouldn't expect any differences in behavior on other Windows releases, but if anyone would like to test on other Windows releases, feel free.

h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code.

Fixes #7990.

The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This commit works around the issue by having explorer.exe launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin. h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code. Fixes bitcoin#7990.

ken2812221

Tested ACK 7d8a8cc

fanquake · 2018-04-16T02:00:11Z

@ken2812221 Could you provide the basic steps you used to test this, so anyone else can recreate on a Windows VM?

ken2812221 · 2018-04-16T06:09:32Z

@fanquake I just add wallet=C:\Windows\xxxx to my config file.

if bitcoin core has higher privilege, it can successfully create the directory, otherwise it crash

laanwj · 2018-04-16T06:12:36Z

Concept ACK - would like to see some more tested ACKs.

jonasschnelli · 2018-04-17T10:53:52Z

Gitian build is here: https://bitcoin.jonasschnelli.ch/build/573

fanquake · 2018-04-18T04:56:03Z

I've tested this using the method @ken2812221 suggested. Basically create a bitcoin.conf with

wallet=C:\Windows\xxxx

If you then install 0.16.0, and choose to run at the end of the installation, Core will error on startup, because we can't specify a path as a wallet name.

2018-04-18 04:48:31 Using 4 threads for script verification
2018-04-18 04:48:31 scheduler thread start
2018-04-18 04:48:31 Using wallet directory C:\Users\User\AppData\Roaming\Bitcoin\wallets
2018-04-18 04:48:31 init message: Verifying wallet(s)...
2018-04-18 04:48:41 Shutdown: In progress...
2018-04-18 04:48:41 scheduler thread interrupt
2018-04-18 04:48:41 Shutdown: done

However if you then install the gitian build provided by @jonasschnelli, and launch Core at the end of the installation, we get an exception. Looking at the debug.log, we no longer have access to C:\Windows\.

2018-04-18T04:40:39Z init message: Verifying wallet(s)...
2018-04-18T04:40:39Z Using BerkeleyDB version Berkeley DB 4.8.30: (April  9, 2010)
2018-04-18T04:40:39Z Using wallet wallet.dat
2018-04-18T04:40:39Z 

************************
EXCEPTION: N5boost10filesystem16filesystem_errorE       
boost::filesystem::create_directory: Access is denied: "C:\Windows\xxxx"       
C:\Program Files\Bitcoin\bitcoin-qt.exe in Runaway exception

laanwj · 2018-04-18T06:37:46Z

@fanquake Thanks for testing. To be clear: All in all that seems a positive result? I suppose you used C:\windows as a path that bitcoin core is supposed to not have access to?

fanquake · 2018-04-18T06:54:04Z

@laanwj Yes, I think it's a positive result. Core should not have access to write files into C:\Windows\.

laanwj · 2018-04-18T09:51:16Z

Right - it's similar to /usr/. I've kind of forgot about windows things somewhat.
Looks good to me, then. Also added "to backport" as sane installer behavior is very important.

…nds. 7d8a8cc Avoid launching as admin when NSIS installer ends. (JeremyRand) Pull request description: The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This PR works around the issue by having `explorer.exe` launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin. I've tested this with Sysinternals Process Explorer on Windows 10 32-bit. I wouldn't expect any differences in behavior on other Windows releases, but if anyone would like to test on other Windows releases, feel free. h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code. Fixes #7990. Tree-SHA512: f40d6b6e5bb72952dcfbf223b68bfeb9a03bd5638f41b1700f4651f6452ce3fe7468129f6652c4f546210a5fd2521b2574c4b6068c5aea01ed2d719a8a838cd8

Michagogo · 2018-04-18T10:26:35Z

This may not be a good idea: https://mdb-blog.blogspot.com/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1388694317801#c939517856791332836

JeremyRand · 2018-04-18T21:41:21Z

@Michagogo I'm not sure whom at Microsoft Ericlaw talked to (he doesn't give any citation), but Microsoft has recommended the approach of using explorer.exe for this.

Michagogo · 2018-04-19T00:25:47Z

I’m not sure if launching explorer.exe with the program as an argument is exactly equivalent to what that page describes (calling various functions directly).

…

On Thu, Apr 19, 2018 at 12:42 AM JeremyRand ***@***.***> wrote: @Michagogo <https://github.com/Michagogo> I'm not sure whom at Microsoft Ericlaw talked to (he doesn't give any citation), but Microsoft has recommended <https://blogs.msdn.microsoft.com/oldnewthing/20131118-00/?p=2643> the approach of using explorer.exe for this. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#12985 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACcNnuY2XCFhgZWIGqt1gT0Qh3biAlPSks5tp7NDgaJpZM4TVEfn> .

JeremyRand · 2018-04-19T05:36:36Z

@Michagogo the Microsoft page I linked says:

The solution here is to go back to Explorer and ask Explorer to launch the program for you. Since Explorer is running as the original unelevated user, the program (in this case, the Web browser) will run as Bob.

So while I haven't audited the Microsoft sample code to verify that it does that (Windows C API's aren't my specialty), I think it's reasonable to infer that the Microsoft sample code matches the Microsoft description (which matches what this PR does).

Michagogo · 2018-04-19T07:49:26Z

Windows C APIs aren’t my specialty either, so maybe someone with more experience could weigh in, but that code definitely doesn’t just run explorer.exe with an argument. Just by skimming it, it’s clear that it somehow looks at the environment to get some kind of handle or something on the running shell and call a function on that. That may, however, be equivalent - I don’t have enough deep Windows knowledge to say for sure what the difference is.

…

On Thu, Apr 19, 2018 at 8:38 AM JeremyRand ***@***.***> wrote: @Michagogo <https://github.com/Michagogo> the Microsoft page I linked says: The solution here is to go back to Explorer and ask Explorer to launch the program for you. Since Explorer is running as the original unelevated user, the program (in this case, the Web browser) will run as Bob. So while I haven't audited the Microsoft sample code to verify that it does that (Windows C API's aren't my specialty), I think it's reasonable to infer that the Microsoft sample code matches the Microsoft description (which matches what this PR does). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#12985 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACcNnvgiN0-Jy6P-unbmA2Ig5JDQ7qDVks5tqCK5gaJpZM4TVEfn> .

The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This commit works around the issue by having explorer.exe launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin. h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code. Fixes bitcoin#7990. GitHub-Pull: bitcoin#12985 Rebased-From: 7d8a8cc

8fca086 List support for BIP173 in bips.md (Pieter Wuille) 9645aa6 Remove blockmaxsize option from init.cpp (fanquake) 7847b92 Default to defining endian-conversion DECLs in compat w/o config (Matt Corallo) 1720eb3 qt:Show the entire Window when double clicking on taskbar (Chun Kuan Lee) e055bc0 depends: Fix Qt build with XCode 9.3 (fanquake) 0684cf9 Avoid launching as admin when NSIS installer ends. (JeremyRand) e802c22 [config] Remove blockmaxsize option (John Newbery) f118a7a Fix illegal default `addProxy` and `addrSeparateProxyTor` settings. (251) f60e84d Limit the number of IPs we use from each DNS seeder (e0) Pull request description: Backports: - #12626 Limit the number of IPs addrman learns from each DNS seeder - #12650 gui: Fix issue: "default port not shown correctly in settings dialog" - #12756 [config] Remove blockmaxsize option - #12985 Windows: Avoid launching as admin when NSIS installer ends. - #12946 depends: Fix Qt build with XCode 9.3 - #12998 Default to defining endian-conversion DECLs in compat w/o config - #12999 qt: Show the Window when double clicking the taskbar icon - #13064 List support for BIP173 in bips.md to the 0.16 branch. Tree-SHA512: 3e6b47c54b2cd2bdd81fbc6176cb31e46423f6e05988984d3a09b3535e3cee101ffb071cf753a4beff3c9f0521eb5de4b7c0424a3e97da801d56b4015847ac0f

The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This commit works around the issue by having explorer.exe launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin. h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code. Fixes bitcoin#7990. GitHub-Pull: bitcoin#12985 Rebased-From: 7d8a8cc

…aller ends. 7d8a8cc Avoid launching as admin when NSIS installer ends. (JeremyRand) Pull request description: The Bitcoin Core NSIS script runs with elevated privileges. Unfortunately, this means that it launches Bitcoin Core itself with elevated privileges when the user chooses to launch Bitcoin Core at the end of the installation procedure. This PR works around the issue by having `explorer.exe` launch Bitcoin Core. Seems to be a similar approach to what http://nsis.sourceforge.net/ShellExecAsUser_plug-in does, but without a plugin. I've tested this with Sysinternals Process Explorer on Windows 10 32-bit. I wouldn't expect any differences in behavior on other Windows releases, but if anyone would like to test on other Windows releases, feel free. h/t to "UK" at https://mdb-blog.blogspot.se/2013/01/nsis-lunch-program-as-user-from-uac.html?showComment=1410158039989#c2463780017054126736 for the sample code. Fixes bitcoin#7990. Tree-SHA512: f40d6b6e5bb72952dcfbf223b68bfeb9a03bd5638f41b1700f4651f6452ce3fe7468129f6652c4f546210a5fd2521b2574c4b6068c5aea01ed2d719a8a838cd8

fanquake added the Windows label Apr 14, 2018

ken2812221 approved these changes Apr 15, 2018

View reviewed changes

laanwj added this to the 0.16.1 milestone Apr 18, 2018

laanwj added the Needs backport label Apr 18, 2018

laanwj merged commit 7d8a8cc into bitcoin:master Apr 18, 2018

fanquake mentioned this pull request Apr 18, 2018

[0.16] Backports #12967

Merged

Bushstar mentioned this pull request Apr 18, 2018

commits from bitcoin/master FeatherCoin/Feathercoin#299

Merged

fanquake removed the Needs backport label May 16, 2018

bitcoin locked as resolved and limited conversation to collaborators Sep 8, 2021

JeremyRand deleted the nsis-de-elevate branch February 13, 2022 09:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Windows: Avoid launching as admin when NSIS installer ends. #12985

Windows: Avoid launching as admin when NSIS installer ends. #12985

Uh oh!

JeremyRand commented Apr 14, 2018

Uh oh!

ken2812221 left a comment •

edited

Loading

Uh oh!

fanquake commented Apr 16, 2018

Uh oh!

ken2812221 commented Apr 16, 2018

Uh oh!

laanwj commented Apr 16, 2018

Uh oh!

jonasschnelli commented Apr 17, 2018

Uh oh!

fanquake commented Apr 18, 2018 •

edited

Loading

Uh oh!

laanwj commented Apr 18, 2018

Uh oh!

fanquake commented Apr 18, 2018

Uh oh!

laanwj commented Apr 18, 2018

Uh oh!

Michagogo commented Apr 18, 2018

Uh oh!

JeremyRand commented Apr 18, 2018

Uh oh!

Michagogo commented Apr 19, 2018 via email

Uh oh!

JeremyRand commented Apr 19, 2018

Uh oh!

Michagogo commented Apr 19, 2018 via email

Uh oh!

Uh oh!

Windows: Avoid launching as admin when NSIS installer ends. #12985

Windows: Avoid launching as admin when NSIS installer ends. #12985

Uh oh!

Conversation

JeremyRand commented Apr 14, 2018

Uh oh!

ken2812221 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fanquake commented Apr 16, 2018

Uh oh!

ken2812221 commented Apr 16, 2018

Uh oh!

laanwj commented Apr 16, 2018

Uh oh!

jonasschnelli commented Apr 17, 2018

Uh oh!

fanquake commented Apr 18, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

laanwj commented Apr 18, 2018

Uh oh!

fanquake commented Apr 18, 2018

Uh oh!

laanwj commented Apr 18, 2018

Uh oh!

Michagogo commented Apr 18, 2018

Uh oh!

JeremyRand commented Apr 18, 2018

Uh oh!

Michagogo commented Apr 19, 2018 via email

Uh oh!

JeremyRand commented Apr 19, 2018

Uh oh!

Michagogo commented Apr 19, 2018 via email

Uh oh!

Uh oh!

ken2812221 left a comment •

edited

Loading

fanquake commented Apr 18, 2018 •

edited

Loading