Launch from Windows installer fails to drop privileges

Having trouble installing or compiling FreeCAD? Get help here.
Forum rules
Be nice to others! Respect the FreeCAD code of conduct!
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Sun Oct 03, 2021 10:43 pm I think the problem is that you see any criticism of the installer as a personal attack.
I never feel attacked by discussions about UI etc. since this is a normal case and often worth the discussion to please as many users as possible.

Here I felt attacked when I heard repeatedly that we have a security issue I should be aware of and I don't act. This implies I am a lazy guy in terms of security. And this in turn implies I am potentially harmful for the project because of my behavior.

However, I think the default should be that the option to start FC from within the installer is off. I am not sure if this already the case. I will check this the next days, and if not change this.
chrisb
Veteran
Posts: 53921
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

Yesterday I was able to install another program (mysql) as a non admin user. This works as I think it should: The installer starts as normal user and asks for admin credentials during the install process. So it is possible to switch while running a program and it is not an absolute requirement to start the program itself as admin.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Tue Oct 05, 2021 8:18 am So it is possible to switch while running a program and it is not an absolute requirement to start the program itself as admin.
Sure, ant that's what the installer allows you. Have you ever tried it out?
chrisb
Veteran
Posts: 53921
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

uwestoehr wrote: Tue Oct 05, 2021 6:21 pm Have you ever tried it out?
Yes, but until now I couldn't try it from a non admin account. From your description above I understood that FreeCAD installer doesn't switch itself, but rather has to be started as admin.
I will not contribute here further until I have tried it on a non admin account.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
GeneFC
Veteran
Posts: 5373
Joined: Sat Mar 19, 2016 3:36 pm
Location: Punta Gorda, FL

Re: Launch from Windows installer fails to drop privileges

Post by GeneFC »

I do not use mysql, but I took a look and it appears the Windows download version is an MSI installer.

We don't even want to think about using that disaster of an installer. :roll:

Gene
User avatar
uwestoehr
Veteran
Posts: 4961
Joined: Sun Jan 27, 2019 3:21 am
Location: Germany
Contact:

Re: Launch from Windows installer fails to drop privileges

Post by uwestoehr »

chrisb wrote: Tue Oct 05, 2021 7:28 pm Yes, but until now I couldn't try it from a non admin account. From your description above I understood that FreeCAD installer doesn't switch itself, but rather has to be started as admin.
But I explained it now several times, please see https://forum.freecadweb.org/viewtopic. ... 70#p537612

And if you choose way 1 and select in the installer to install for all users, the installer is requesting admin permissions and if you do so you switch the user for the installer.

Since you are admin, you can quickly create a normal user account and play around.
chrisb
Veteran
Posts: 53921
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

uwestoehr wrote: Sat Oct 02, 2021 11:37 pm - log in to a normal user account and start the installer
- what do you get? Is the installer asking you for admin permissions?
- No. (If it does, please tell me since this would be a bug.)
So to run the installer as admin you must use Windows "run as admin" context menu -> so it is your explicit will to run it as admin.
That's what I based my statement on. I'm afraid I have to see myself what happens.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
User avatar
sgrogan
Veteran
Posts: 6499
Joined: Wed Oct 22, 2014 5:02 pm

Re: Launch from Windows installer fails to drop privileges

Post by sgrogan »

uwestoehr wrote: Tue Oct 05, 2021 9:37 pm Since you are admin, you can quickly create a normal user account and play around.
Is there a Win user that hasn't installed Notepad++?
I think it would be a good test case.
I think everything @uwestoeht is factual, but maybe FreeCAD has grown to the point that it could protect the user from themselves.

If no one else can run the experiment, I will try it myself. I really don't want to. It's taken some time to have this editor as my default.
"fight the good fight"
chrisb
Veteran
Posts: 53921
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

Finally I could test the install from a non admin account.

- The setup starts without asking for admin right
- the proposed path is c:\Users\<username>\AppData\Local\Programs\FreeCAD 0.19. (I think spaces in such directory names should be avoided, but that's another story).
- I used further defaults for desktop icon, menu, etc.
- There was no question to install it for all users,
- after the installation before finishing I can check "Start FreeCAD".
- FreeCAD runs as the non admin user

I will continue later with installing as admin from the same account.
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
chrisb
Veteran
Posts: 53921
Joined: Tue Mar 17, 2015 9:14 am

Re: Launch from Windows installer fails to drop privileges

Post by chrisb »

Add a multiuser installation on top of a single user installation
- precondition: FreeCAD is installed for a single user as in the post above
- start install as admin
- question asked if the installation is for all users or only for me. Answer: All users
- proposed install directory is C:\Program Files\FreeCAD 0.19
- if the checkbox to start FreeCAD after install is checked, FreeCAD is started as admin. This is expected as a test for all users. It could be slightly improved with a different text at the checkbox; see below.

Flaw1: FreeCAD is now always shown as a newly installed program. Probably because it was installed for the user and for all users.

Uninstall non admin installation
Flaw2: Even the installation for the current user needs admin rights to be uninstalled. Alas, it is not possible to start this uninstall as admin. Switching to admin user doesn't help, because the installation of the non admin user is not shown there.

Uninstall all users installation as admin and after that for current user
Works.

Install as admin for current user (without existance of another install before)
- start install as admin
- question asked if the installation is for all users or only for me. Answer: only for me
- proposed install directory is c:\Users\<username>\AppData\Local\Programs\FreeCAD 0.19
- if the checkbox to start FreeCAD after install is checked, FreeCAD is started as admin.
Having selected to install for the current user only, it seems not completely wrong for a not too educated user to expect that in this case FreeCAD is also run as current user.

I see two options to improve this:
1) if installed for current user, then run FreeCAD - if so selected - as current user. There is no good reason to run FreeCAD in this case as admin. The argument that it is not known to which user the install program should switch to is not true. As seen when proposing the install directory the user is well known. (I tested this with a command shell started as admin: the environment variable USERNAME still holds the name of the non admin user, so it's even simpler than assumed above.)

2) Tell the user that FreeCAD in this case will be run as admin. This could be done by changing the text of the checkbox.

Because it is not completely abstruse to install FreeCAD first for one user and later for all, I would create a minor bug report concerning the uninstall issue described above.
How about a ticket for the improvements?
A Sketcher Lecture with in-depth information is available in English, auf Deutsch, en français, en español.
Post Reply