Launch from Windows installer fails to drop privileges

Having trouble installing or compiling FreeCAD? Get help here.
Forum rules
Be nice to others! Respect the FreeCAD code of conduct!
GeneFC
Veteran
Posts: 5373
Joined: Sat Mar 19, 2016 3:36 pm
Location: Punta Gorda, FL

Re: Launch from Windows installer fails to drop privileges

Post by GeneFC »

chrisb wrote: Sun Oct 17, 2021 11:26 pm This is the sequence of the setup dialogs when started as normal user, who has no additional admin account. I don't see the option to install for all users.
That is correct. But the normal user *does* have extra privileges available in a standard Windows installation. Those privileges are available to be called up even if the user is logged in as a basic ordinary user. Read carefully what sgrogan said above.

Windows communicates with the FreeCAD installer and the offer to install for all users is presented.

Gene
chrisb
Veteran
Posts: 53920
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

GeneFC wrote: Sun Oct 17, 2021 11:39 pm But the normal user *does* have extra privileges available in a standard Windows installation.
That's why I mentioned the difference.

From what I can see there isn't a serious security issue. However, a modified message could help clarifying things.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
chrisb
Veteran
Posts: 53920
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

chrisb wrote: Sun Oct 17, 2021 11:33 pm Install throws a message that it cannot remove Coin4.dll:
This seems to be a false positive. The reason is probably that the setup has no right permissions and throws the wrong message.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Sat Oct 16, 2021 10:27 am - The setup starts without asking for admin right
- the proposed path is c:\Users\<username>\AppData\Local\Programs\FreeCAD 0.19. (I think spaces in such directory names should be avoided, but that's another story).
- I used further defaults for desktop icon, menu, etc.
- There was no question to install it for all users,
- after the installation before finishing I can check "Start FreeCAD".
- FreeCAD runs as the non admin user
This is all correct. The proposed path is Windows' standard. Spaces in file and foldernames are the standard since years now in the Windows world. (I wonder why the info that spaces or accented characters is so persistent. Windows uses Unicode in all respects.)
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Sat Oct 16, 2021 10:06 pm - precondition: FreeCAD is installed for a single user as in the post above
- start install as admin
This is possible and lead to two parallel installations that don't interfer with each other, except of the setting which one of the 2 will open the *.FCSTD files.
This feature is useful for users like me who won't use the FC version the admin set up (admin set up FC 0.19 but I work with FC 0.20 dev).
chrisb wrote: Sat Oct 16, 2021 10:06 pm Flaw1: FreeCAD is now always shown as a newly installed program. Probably because it was installed for the user and for all users.
Yes, Windows shows you all recent installed programs, depending in the settings the admin made, also the ones the admin installed.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Uninstall non admin installation
Flaw2: Even the installation for the current user needs admin rights to be uninstalled.
That is not correct. Only when the admin wants to uninstall the user's installation, he must enter admin credentials. This is clear since only the user who installed a program can uninstall it. The only exception is the admin.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Switching to admin user doesn't help, because the installation of the non admin user is not shown there.
It is there and as admin you know n what folder you have to look. There are also some tools available for admins showing you local installations.

So again, admins must know what they are doing. We drifting away from FC since this is all Windows stuff, nothing specially related to FC.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Install as admin for current user (without existance of another install before)
- start install as admin
- question asked if the installation is for all users or only for me. Answer: only for me
- proposed install directory is c:\Users\<username>\AppData\Local\Programs\FreeCAD 0.19
- if the checkbox to start FreeCAD after install is checked, FreeCAD is started as admin.
Having selected to install for the current user only, it seems not completely wrong for a not too educated user to expect that in this case FreeCAD is also run as current user.
Again, Windows is just following your will, and this is good. You decided to install as admin only for the current user. This user is you, so the admin. Such an installation is important for admins to test things out before every user sees something.
chrisb wrote: Sat Oct 16, 2021 10:06 pm I see two options to improve this:
1) if installed for current user, then run FreeCAD - if so selected - as current user. There is no good reason to run FreeCAD in this case as admin.
But this is only the case, if you installed it only for the admin user. In every case FC is run OPTIONALLY after the installation as the user who installed it. This cannot be changed technically as I explained here a few times.
chrisb wrote: Sat Oct 16, 2021 10:06 pm 2) Tell the user that FreeCAD in this case will be run as admin. This could be done by changing the text of the checkbox.
But in this case he is the admin, installed it for hisself, so of course every program he starts have admin permissions.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Because it is not completely abstruse to install FreeCAD first for one user and later for all, I would create a minor bug report concerning the uninstall issue described above.
As stated above this is not abstruse but very useful for many users.
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

sgrogan wrote: Sun Oct 17, 2021 4:14 pm 1- Leave as is, this is the default behavior of the NCIS software we use to make the installer.
2- Use an add-on to "protect the user from themselves"
3- Exit the installer after performing the tasks that require admin, i.e. don't allow FreeCAD start from within the installer.
We should not act special. FC is just an application, nothing special. (Several installers I recently used (Inkscape, Audacity etc. behave like our installer).
As I stated here several times, installing as admin is designed for admins and the option to run FC after the installation is for them. Option 2 or 3 would make the feature unusable as I explained several times.

What I will now (as soon I find time) do is to assure the option is off by default. So people with less knowledge will not run into this.

--------------
I cannot confirm the behavior you described. What Windows version did you use?
I gave it a try with Win 10 Pro 21H1. You then start with a single account that has admin privileges of course. So all you do with this is on admin level. When I execute e.g. regedit.exe, I can directly modify HKLM, so regedit has admin permissions. Same is with the cmd.exe, python.exe and the like. Maybe Win 10 pro behaves different than the Home edition but I only have access to the Pro version.
chrisb
Veteran
Posts: 53920
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

uwestoehr wrote: Mon Oct 25, 2021 10:24 am The proposed path is Windows' standard. Spaces in file and foldernames are the standard since years now in the Windows world. (I wonder why the info that spaces or accented characters is so persistent. Windows uses Unicode in all respects.)
I know this. But don't you think it is a good idea to avoid problems if they can be avoided at no cost? Did you ever hear of someone who had problems with a file or path because he had no spaces nor accented characters?
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
chrisb
Veteran
Posts: 53920
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

uwestoehr wrote: Mon Oct 25, 2021 10:40 am
chrisb wrote: Sat Oct 16, 2021 10:06 pm - precondition: FreeCAD is installed for a single user as in the post above
- start install as admin
This is possible and lead to two parallel installations that don't interfer with each other, except of the setting which one of the 2 will open the *.FCSTD files.
This feature is useful for users like me who won't use the FC version the admin set up (admin set up FC 0.19 but I work with FC 0.20 dev).
chrisb wrote: Sat Oct 16, 2021 10:06 pm Flaw1: FreeCAD is now always shown as a newly installed program. Probably because it was installed for the user and for all users.
Yes, Windows shows you all recent installed programs, depending in the settings the admin made, also the ones the admin installed.
I know this as you say for newly installed progams. Until now I thought that "newly installed" means until the program is run once. But as I said, it is in this situation always shown as newly installed program, no matter how often I run it.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Uninstall non admin installation
Flaw2: Even the installation for the current user needs admin rights to be uninstalled.
That is not correct. Only when the admin wants to uninstall the user's installation, he must enter admin credentials. This is clear since only the user who installed a program can uninstall it. The only exception is the admin.
Sad to say, but I can only agree that the behaviour I see is not correct.
I had the double installation, was logged in as non admin and wanted to uninstall the non admin version as non admin user. Did you test this setup? I can try to do it again and make some screenshots.
chrisb wrote: Sat Oct 16, 2021 10:06 pm 2) Tell the user that FreeCAD in this case will be run as admin. This could be done by changing the text of the checkbox.
But in this case he is the admin, installed it for hisself, so of course every program he starts have admin permissions.
In an ideal world you could be right with your rather optimistic view of Windows admins. I could also repeat things that have been said here before, but such repitions don't make anything more or less true. If it is all like this, then why not make it even more explicit?
You seem to be in a defense-only mode (as the following quote shows), so a call for an improvement is not directed to you, but rather to someone who can and wants to do these really rather unimportant improvements.
Or you sit back, take a deep breath, sip on your preferred beverage, and play with the thought, that there could be a world where you and others could be right.
chrisb wrote: Sat Oct 16, 2021 10:06 pm Because it is not completely abstruse to install FreeCAD first for one user and later for all, I would create a minor bug report concerning the uninstall issue described above.
As stated above this is not abstruse but very useful for many users.
Please read my comment properly, I said as well, that it is not abstruse. Yet the use case where a non admin user wants to uninstall his local version cannot be handled. At least not here.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Mon Oct 25, 2021 10:01 pm I know this. But don't you think it is a good idea to avoid problems if they can be avoided at no cost?
I understand your intention but the proposed folder is Windows' default. Not using Windows' the default would even be problematic.
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Mon Oct 25, 2021 11:18 pm I know this as you say for newly installed progams. Until now I thought that "newly installed" means until the program is run once. But as I said, it is in this situation always shown as newly installed program, no matter how often I run it.
"Newly installed" means actually recently installed (last days, might be even a month, but don't remember). So this has nothing to do with how often you start it. I think this behavior can be changed somewhere in Windows settings.

chrisb wrote: Sat Oct 16, 2021 10:06 pm Sad to say, but I can only agree that the behaviour I see is not correct.
I had the double installation, was logged in as non admin and wanted to uninstall the non admin version as non admin user. Did you test this setup? I can try to do it again and make some screenshots.
That would be helpful. What is the error message you get?
Here I can without problems uninstall the non-Admin version when I am non-admin.
(Note that when you try to uninstall the non-admin version while being the admin, you cannot just use the system settings, but either executing the uninstaller .exe file directly or run the system settings as the non-admin user.)

chrisb wrote: Sat Oct 16, 2021 10:06 pm In an ideal world you could be right with your rather optimistic view of Windows admins.
As you wrote, repetition don't help anymore. The installer of FC is not there to teach people how to use Windows. FC is just a normal program like every other program around on your Windows system. The Windows rights management applies for all programs. And it does not help to state again and again that you don't like this.
I can only speak from the technical point of view that Windows follows your will and thus I cannot blame the OS.

chrisb wrote: Sat Oct 16, 2021 10:06 pm You seem to be in a defense-only mode (as the following quote shows), so a call for an improvement is not directed to you, but rather to someone who can and wants to do these really rather unimportant improvements.
You miss the point: What you call "improvement" would mean to get rid of the feature. I explained it quite often and you must admit that I was very patient. However at some point I cannot repeat again and again. If you don't like the feature, feel free to remove it but expect complaints from admins about the missing feature.

chrisb wrote: Sat Oct 16, 2021 10:06 pm Please read my comment properly, I said as well, that it is not abstruse.
Please excuse, I misread your sentence.
Post Reply