WIXFEAT:2006,2580,2751 Add Inheritable attribute to PermissionEx.
Sean Hall committed
May 23, 2020 at 15:55 UTC
6fbe9b0b7e98e63daa89c1347e5388dec9fdc57f
6 files changed
+47
-7
src/ca/secureobj.cpp
+19
-6
@@ -3,10 +3,10 @@
3
#include "precomp.h"
4
5
// structs
6
-LPCWSTR wzQUERY_SECUREOBJECTS = L"SELECT `Wix4SecureObject`.`Wix4SecureObject`, `Wix4SecureObject`.`Table`, `Wix4SecureObject`.`Domain`, `Wix4SecureObject`.`User`, "
6
+LPCWSTR wzQUERY_SECUREOBJECTS = L"SELECT `Wix4SecureObject`.`Wix4SecureObject`, `Wix4SecureObject`.`Table`, `Wix4SecureObject`.`Domain`, `Wix4SecureObject`.`User`, `Wix4SecureObject`.`Attributes`, "
7
L"`Wix4SecureObject`.`Permission`, `Wix4SecureObject`.`Component_`, `Component`.`Attributes` FROM `Wix4SecureObject`,`Component` WHERE "
8
L"`Wix4SecureObject`.`Component_`=`Component`.`Component`";
9
-enum eQUERY_SECUREOBJECTS { QSO_SECUREOBJECT = 1, QSO_TABLE, QSO_DOMAIN, QSO_USER, QSO_PERMISSION, QSO_COMPONENT, QSO_COMPATTRIBUTES };
9
+enum eQUERY_SECUREOBJECTS { QSO_SECUREOBJECT = 1, QSO_TABLE, QSO_DOMAIN, QSO_USER, QSO_ATTRIBUTES, QSO_PERMISSION, QSO_COMPONENT, QSO_COMPATTRIBUTES };
10
11
LPCWSTR wzQUERY_REGISTRY = L"SELECT `Registry`.`Registry`, `Registry`.`Root`, `Registry`.`Key` FROM `Registry` WHERE `Registry`.`Registry`=?";
12
enum eQUERY_OBJECTCOMPONENT { QSOC_REGISTRY = 1, QSOC_REGROOT, QSOC_REGKEY };
@@ -16,6 +16,11 @@ enum eQUERY_SECURESERVICEINSTALL { QSSI_NAME = 1 };
16
17
enum eOBJECTTYPE { OT_UNKNOWN, OT_SERVICE, OT_FOLDER, OT_FILE, OT_REGISTRY };
18
19
+enum eSECURE_OBJECT_ATTRIBUTE
20
+{
21
+ SECURE_OBJECT_ATTRIBUTE_INHERITABLE = 0x1,
22
+};
23
+
24
static eOBJECTTYPE EObjectTypeFromString(
25
__in LPCWSTR pwzTable
26
)
@@ -335,6 +340,7 @@ extern "C" UINT __stdcall SchedSecureObjects(
340
341
DWORD cObjects = 0;
342
eOBJECTTYPE eType = OT_UNKNOWN;
343
+ DWORD dwAttributes = 0;
344
345
//
346
// initialize
@@ -409,7 +415,6 @@ extern "C" UINT __stdcall SchedSecureObjects(
415
// add the data to the CustomActionData
416
hr = WcaGetRecordString(hRec, QSO_SECUREOBJECT, &pwzData);
417
ExitOnFailure(hr, "failed to get name of object");
412
-
418
hr = WcaWriteStringToCaData(pwzTable, &pwzCustomActionData);
419
ExitOnFailure(hr, "failed to add data to CustomActionData");
420
@@ -423,6 +428,11 @@ extern "C" UINT __stdcall SchedSecureObjects(
428
hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
429
ExitOnFailure(hr, "failed to add data to CustomActionData");
430
431
+ hr = WcaGetRecordInteger(hRec, QSO_ATTRIBUTES, reinterpret_cast<int*>(&dwAttributes));
432
+ ExitOnFailure(hr, "failed to get attributes to configure object");
433
+ hr = WcaWriteIntegerToCaData(dwAttributes, &pwzCustomActionData);
434
+ ExitOnFailure(hr, "failed to add data to CustomActionData");
435
+
436
hr = WcaGetRecordString(hRec, QSO_PERMISSION, &pwzData);
437
ExitOnFailure(hr, "failed to get permission to configure object");
438
hr = WcaWriteStringToCaData(pwzData, &pwzCustomActionData);
@@ -568,7 +578,7 @@ LExit:
578
called as Type 1025 CustomAction (deferred binary DLL)
579
580
NOTE: deferred CustomAction since it modifies the machine
571
- NOTE: CustomActionData == wzObject\twzTable\twzDomain\twzUser\tdwPermissions\twzObject\t...
581
+ NOTE: CustomActionData == wzObject\twzTable\twzDomain\twzUser\tdwAttributes\tdwPermissions\t...
582
******************************************************************/
583
extern "C" UINT __stdcall ExecSecureObjects(
584
__in MSIHANDLE hInstall
@@ -586,6 +596,7 @@ extern "C" UINT __stdcall ExecSecureObjects(
596
DWORD dwRevision = 0;
597
LPWSTR pwzUser = NULL;
598
DWORD dwPermissions = 0;
599
+ DWORD dwAttributes = 0;
600
LPWSTR pwzAccount = NULL;
601
PSID psid = NULL;
602
@@ -626,8 +637,10 @@ extern "C" UINT __stdcall ExecSecureObjects(
637
ExitOnFailure(hr, "failed to process CustomActionData");
638
hr = WcaReadStringFromCaData(&pwz, &pwzUser);
639
ExitOnFailure(hr, "failed to process CustomActionData");
640
+ hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwAttributes));
641
+ ExitOnFailure(hr, "failed to process CustomActionData");
642
hr = WcaReadIntegerFromCaData(&pwz, reinterpret_cast<int*>(&dwPermissions));
630
- ExitOnFailure(hr, "failed to processCustomActionData");
643
+ ExitOnFailure(hr, "failed to process CustomActionData");
644
645
WcaLog(LOGMSG_VERBOSE, "Securing Object: %ls Type: %ls User: %ls", pwzObject, pwzTable, pwzUser);
646
@@ -690,7 +703,7 @@ extern "C" UINT __stdcall ExecSecureObjects(
703
//
704
ea.grfAccessMode = SET_ACCESS;
705
693
- if (0 == lstrcmpW(L"CreateFolder", pwzTable))
706
+ if (dwAttributes & SECURE_OBJECT_ATTRIBUTE_INHERITABLE)
707
{
708
ea.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;
709
}
src/test/WixToolsetTest.Util/UtilExtensionFixture.cs
+1
-1
@@ -105,7 +105,7 @@ namespace WixToolsetTest.Util
105
"CustomAction:Wix4ExecSecureObjectsRollback_X64\t11521\tWix4UtilCA_X64\tExecSecureObjectsRollback\t",
106
"CustomAction:Wix4SchedSecureObjects_X64\t1\tWix4UtilCA_X64\tSchedSecureObjects\t",
107
"CustomAction:Wix4SchedSecureObjectsRollback_X64\t1\tWix4UtilCA_X64\tSchedSecureObjectsRollback\t",
108
- "Wix4SecureObject:INSTALLFOLDER\tCreateFolder\t\tEveryone\t268435456\tfilF5_pLhBuF5b4N9XEo52g_hUM5Lo",
108
+ "Wix4SecureObject:INSTALLFOLDER\tCreateFolder\t\tEveryone\t1\t268435456\tfilF5_pLhBuF5b4N9XEo52g_hUM5Lo",
109
}, results.OrderBy(s => s).ToArray());
110
}
111
src/wixext/Tuples/SecureObjectsTuple.cs
+8
@@ -15,6 +15,7 @@ namespace WixToolset.Util
15
new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Table), IntermediateFieldType.String),
16
new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Domain), IntermediateFieldType.String),
17
new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.User), IntermediateFieldType.String),
18
+ new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Attributes), IntermediateFieldType.Number),
19
new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Permission), IntermediateFieldType.Number),
20
new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.ComponentRef), IntermediateFieldType.String),
21
},
@@ -32,6 +33,7 @@ namespace WixToolset.Util.Tuples
33
Table,
34
Domain,
35
User,
36
+ Attributes,
37
Permission,
38
ComponentRef,
39
}
@@ -72,6 +74,12 @@ namespace WixToolset.Util.Tuples
74
set => this.Set((int)SecureObjectsTupleFields.User, value);
75
}
76
77
+ public int Attributes
78
+ {
79
+ get => this.Fields[(int)SecureObjectsTupleFields.Attributes].AsNumber();
80
+ set => this.Set((int)SecureObjectsTupleFields.Attributes, value);
81
+ }
82
+
83
public int? Permission
84
{
85
get => this.Fields[(int)SecureObjectsTupleFields.Permission].AsNullableNumber();
src/wixext/UtilCompiler.cs
+13
@@ -49,6 +49,11 @@ namespace WixToolset.Util
49
TypeMask = 0xf,
50
}
51
52
+ internal enum WixPermissionExAttributes
53
+ {
54
+ Inheritable = 0x01
55
+ }
56
+
57
internal enum WixRemoveFolderExOn
58
{
59
Install = 1,
@@ -2367,6 +2372,8 @@ namespace WixToolset.Util
2372
string domain = null;
2373
string[] specialPermissions = null;
2374
string user = null;
2375
+ var inheritable = YesNoType.NotSet;
2376
+ int attributes = 0;
2377
2378
var permissionType = PermissionType.SecureObjects;
2379
@@ -2407,6 +2414,9 @@ namespace WixToolset.Util
2414
}
2415
domain = this.ParseHelper.GetAttributeValue(sourceLineNumbers, attrib);
2416
break;
2417
+ case "Inheritable":
2418
+ inheritable = this.ParseHelper.GetAttributeYesNoValue(sourceLineNumbers, attrib);
2419
+ break;
2420
case "User":
2421
user = this.ParseHelper.GetAttributeValue(sourceLineNumbers, attrib);
2422
break;
@@ -2444,6 +2454,8 @@ namespace WixToolset.Util
2454
this.Messaging.Write(ErrorMessages.GenericReadNotAllowed(sourceLineNumbers));
2455
}
2456
2457
+ attributes |= inheritable == YesNoType.No ? 0 : (int)WixPermissionExAttributes.Inheritable; // default to inheritable.
2458
+
2459
this.ParseHelper.ParseForExtensionElements(this.Context.Extensions, intermediate, section, element);
2460
2461
if (!this.Messaging.EncounteredError)
@@ -2457,6 +2469,7 @@ namespace WixToolset.Util
2469
Table = tableName,
2470
Domain = domain,
2471
User = user,
2472
+ Attributes = attributes,
2473
Permission = permission,
2474
ComponentRef = componentId,
2475
});
src/wixext/UtilTableDefinitions.cs
+1
@@ -164,6 +164,7 @@ namespace WixToolset.Util
164
new ColumnDefinition("Table", ColumnType.String, 32, primaryKey: true, nullable: false, ColumnCategory.Text, description: "Table SecureObject should be securing"),
165
new ColumnDefinition("Domain", ColumnType.String, 255, primaryKey: true, nullable: true, ColumnCategory.Text, description: "Domain half of user account to secure", modularizeType: ColumnModularizeType.Property),
166
new ColumnDefinition("User", ColumnType.String, 255, primaryKey: true, nullable: false, ColumnCategory.Text, description: "User name half of user account to secure", modularizeType: ColumnModularizeType.Property),
167
+ new ColumnDefinition("Attributes", ColumnType.Number, 4, primaryKey: false, nullable: false, ColumnCategory.Integer, minValue: 0, maxValue: 2147483647, description: "A 32-bit word that specifies the attribute flags to be applied."),
168
new ColumnDefinition("Permission", ColumnType.Number, 4, primaryKey: false, nullable: true, ColumnCategory.Unknown, minValue: -2147483647, maxValue: 2147483647, description: "Permissions to grant to User"),
169
new ColumnDefinition("Component_", ColumnType.String, 72, primaryKey: false, nullable: false, ColumnCategory.Identifier, keyTable: "Component", keyColumn: 1, description: "Foreign key into the Component table used to determine install state", modularizeType: ColumnModularizeType.Column),
170
},
src/wixext/util.xsd
+5
@@ -775,6 +775,11 @@
775
<xs:complexType>
776
<xs:attribute name="Domain" type="xs:string"></xs:attribute>
777
<xs:attribute name="User" use="required" type="xs:string"></xs:attribute>
778
+ <xs:attribute name="Inheritable" type="xs:YesNoType">
779
+ <xs:annotation>
780
+ <xs:documentation>Whether the permissions are inheritable. The default is "yes".</xs:documentation>
781
+ </xs:annotation>
782
+ </xs:attribute>
783
<!-- Common ACLs -->
784
<xs:attribute name="Read" type="YesNoType"></xs:attribute>
785
<xs:attribute name="Delete" type="YesNoType"></xs:attribute>