How to include inherited permissions when specifying permissions for a file installed by Wix / Windows Installer?

问题

The Wix source code that I feed to the Wix compiler to build an MSI package for my application, contains the following PermissionEx directive, part of a file component which Windows Installer should install with additional (to those that should be inherited by default) permissions:

<PermissionEx Sddl="D:AR(A;;FW;;;BU)" />

As you can surmise, I intend to install the file with inherited permissions ("AR") included in its ACL and on top of that allow members of the Built-in Users group ("BU") to be allowed ("A") to write to the file ("FW").

The code above does not have the desired effect -- the file is installed, but only that single explicit ACE is listed, none of the ACEs that are supposed to be inherited from parent folder.

In contrast, if I subsequently remove all permissions from the file and run cacls file /S:D:AR(A;;FW;;;BU), i.e. specify exactly the same SDDL string, it does work as intended -- the permissions from parent are inherited and form part of the ACL, together with the explicit non-inherited ACE.

I am using Wix 3.11.1.2318 and the Windows Installer version is 5.0.16299.611, all running on Windows 10 Enterprise 64-bit. Orca tells me the MsiLockPermissionsEx table embedded in my built MSI file is populated with the intended SDDL record. So why is the file created without inheriting permissions from its containing folder?

I tried to use "AI" in place of "AR", and both strings together, but none of it had any effect either.

Is this some known limitation or a quirk with Windows Installer? I know that people were talking a while back how the old LockPermissions table (the one specified for Windows Installer versions earlier than 5) was inadequate in this specific regard -- inherited permissions, namely -- but they also said Microsoft was out to address this very issue with the new table feature.

Otherwise what am I doing wrong?

回答1:

Take a look at WiX's custom PermissionEx in the Util extension.

http://wixtoolset.org/documentation/manual/v3/xsd/util/permissionex.html

回答2:

Given your knowledge in this field, you probably have already tried this. It would also be much better to eliminate the need for permissioning, but two snippets for you - notice the Append attribute:

Create a WiX project in Visual Studio. Add the Util namespace to the WiX element:

<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
     xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">

In Visual Studio project, right click References and add reference to "%ProgramFiles(x86)%\WiX Toolset v3.11\bin\WixUtilExtension.dll".

Permission Folder:

<Component Feature="ProductFeature" Id="Test.exe" Guid="PUT-GUID-HERE">
   <File Source="C:\Test.exe" />
   <CreateFolder>
     <util:PermissionEx User="Power Users" GenericWrite="yes"  />
   </CreateFolder>
</Component>

Permission File:

<Component>
   <File Source="C:\Test2.exe">
      <util:PermissionEx Append="yes" User="Users" GenericWrite="yes" />
    </File>
</Component>

来源：https://stackoverflow.com/questions/55145282/how-to-include-inherited-permissions-when-specifying-permissions-for-a-file-inst

标签

wix

windows-installer

msiexec