Running custom bindist's shim requires elevated permissions on Windows #1149

jasagredo · 2024-11-11T08:47:03Z

I have a GHC 9.6.6 with some patches on top that I use daily, named 9.6.6-patched in GHCup.

This GHC was installed via hadrian binary-dist, then ghcup install ghc -u file:///<path-to-bindist> 9.6.6-patched.

I can run it from the ghc.exe shim:

➜ /c/ghcup/bin/ghc.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

The shim file for this one and ghc-9.6.6-patched.exe are the same, and the executables are the same (via diff):

➜ cat /c/ghcup/bin/ghc.shim
path = C:\ghcup\ghc\9.6.6-patched\bin\ghc.exe%

➜ cat /c/ghcup/bin/ghc-9.6.6-patched.shim
path = C:\ghcup\ghc\9.6.6-patched\bin\ghc.exe%

➜ diff ghc.exe ghc-9.6.6-patched.exe; echo $?
0

➜ ls -lah ghc.exe ghc-9.6.6-patched.exe
-rwxr-xr-x 1 Javier Javier 113K May  6  2024 ghc.exe
-rwxr-xr-x 1 Javier Javier 113K May  6  2024 ghc-9.6.6-patched.exe

However, running the ghc-9.6.6-patched.exe executable results in a permission error unless we are in an elevated shell:

# normal shell
~
➜ /c/ghcup/bin/ghc-9.6.6-patched.exe
zsh: permission denied: /c/ghcup/bin/ghc-9.6.6-patched.exe

# elevated shell
Administrator in ~
➜ /c/ghcup/bin/ghc-9.6.6-patched.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

I found this out via the following error when compiling HLS for this GHC:

[ Info  ] Building HLS 2.9.0.1 for GHC version 9.6.6-patched
Searching for curl in path.
Found curl at C:\WINDOWS\SYSTEM32\curl.exe
Searching for powershell in path.
Found powershell at C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Searching for wget in path.
Found wget at C:\msys64\usr\bin\wget.exe
Selected http transport implementation: curl
File monitor 'config' changed: first run
Project settings changed, reconfiguring...
creating
C:\ghcup\tmp\ghcup-9822830f4a81c589\haskell-language-server-2.9.0.1\dist-newstyle\cache
creating
C:\ghcup\tmp\ghcup-9822830f4a81c589\haskell-language-server-2.9.0.1\dist-newstyle
creating
C:\ghcup\tmp\ghcup-9822830f4a81c589\haskell-language-server-2.9.0.1\dist-newstyle\cache
Warning: cannot determine version of C:\ghcup\bin\ghc-9.6.6-patched.exe :
""
Error: [Cabal-1008]
The program 'ghc' version >=7.0.1 is required but the version of C:\ghcup\bin\ghc-9.6.6-patched.exe could not be determined.
CallStack (from HasCallStack):
  dieWithException, called at src\Distribution\Simple\Program\Db.hs:520:13 in Cabal-3.12.1.0-inplace:Distribution.Simple.Program.Db

File monitor 'compiler' changed: first run
Compiler settings changed, reconfiguring...
Searching for ghc-9.6.6-patched in path.
Found ghc-9.6.6-patched at C:\ghcup\bin\ghc-9.6.6-patched.exe
Running: "C:\ghcup\bin\ghc-9.6.6-patched.exe" "--numeric-version"
Error: [GHCup-08841] BuildFailed failed in dir C:\ghcup\tmp\ghcup-9822830f4a81c589\haskell-language-server-2.9.0.1: Process "cabal" with arguments ["v2-install",
                                                                                                                               "-w",
                                                                                                                               "ghc-9.6.6-patched",
                                                                                                                               "--install-method=copy",
                                                                                                                               "--overwrite-policy=always",
                                                                                                                               "--disable-profiling",
                                                                                                                               "--disable-tests",
                                                                                                                               "--installdir=C:\\ghcup\\tmp\\ghcup-9822830f4a81c589\\haskell-language-server-2.9.0.1\\out\\9.6.6-patched",
                                                                                                                               "--project-file=cabal.project",
                                                                                                                               "-v3",
                                                                                                                               "exe:haskell-language-server",
                                                                                                                               "exe:haskell-language-server-wrapper"] failed with exit code 1.
Press enter to continue

Note this succeeds in an elevated shell:


Administrator in ~
❯ ghcup tui
[ Info  ] verifying digest of: gs.exe
[ Info  ] Updating cabal DB
Downloading the latest package lists from:
- hackage.haskell.org
- cardano-haskell-packages
Package list of cardano-haskell-packages is up to date.
The index-state is set to 2024-11-05T09:09:23Z.
Package list of hackage.haskell.org is up to date.
The index-state is set to 2024-11-11T04:00:37Z.
[ Info  ] downloading: https://downloads.haskell.org/~ghcup/unofficial-bindists/haskell-language-server/2.9.0.1/haskell-language-server-2.9.0.1-src.tar.gz as file C:\ghcup\tmp\ghcup-bf169583f4abc607\haskell-language-server-2.9.0.1-src.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 7058k  100 7058k    0     0  18.4M      0 --:--:-- --:--:-- --:--:-- 18.5M
[ Info  ] verifying digest of: haskell-language-server-2.9.0.1-src.tar.gz
[ Info  ] Unpacking: haskell-language-server-2.9.0.1-src.tar.gz to C:\ghcup\tmp\ghcup-2e4270a6ac1940a3
[ Info  ] Building HLS 2.9.0.1 for GHC version 9.6.6-patched
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\haskell-language-server-2.9.0.1.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\hie-compat-0.3.1.2.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\shake-bench-0.2.0.0.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\hls-graph-2.9.0.1.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\ghcide-2.9.0.1.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\hls-plugin-api-2.9.0.1.tar.gz
Wrote tarball sdist to
C:\ghcup\tmp\ghcup-2e4270a6ac1940a3\haskell-language-server-2.9.0.1\dist-newstyle\sdist\hls-test-utils-2.9.0.1.tar.gz
Resolving dependencies...
Build profile: -w ghc-9.6.6 -O1
In order, the following will be built (use -v for more details):
...

The text was updated successfully, but these errors were encountered:

hasufell · 2024-11-11T08:56:24Z

This is not proof that there's something wrong with the shim.

Can you run C:\ghcup\ghc\9.6.6-patched\bin\ghc.exe without elevated privileges?

jasagredo · 2024-11-11T08:58:58Z

Yes I can:

~
➜ /c/ghcup/ghc/9.6.6-patched/bin/ghc.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

hasufell · 2024-11-11T11:03:47Z

Is antivirus off?

jasagredo · 2024-11-11T11:41:08Z

Yes, it is off.

dfordivam · 2024-11-12T05:34:42Z

I could not reproduce the issue, I tried with zsh too.

I installed the official https://downloads.haskell.org/~ghc/9.6.6/ghc-9.6.6-x86_64-unknown-mingw32.tar.xz with the name "ghc-9.6.6-patched" for testing

jasagredo · 2024-11-12T07:24:44Z

Surprisingly that works for me too.

➜ ghcup install ghc -u https://downloads.haskell.org/\~ghc/9.6.6/ghc-9.6.6-x86_64-unknown-mingw32.tar.xz 9.6.6-upstream
[ Info  ] downloading: https://raw.githubusercontent.com/haskell/ghcup-metadata/master/ghcup-0.0.8.yaml as file C:\ghcup\cache\ghcup-0.0.8.yaml
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
[ Warn  ] New ghc version available. If you want to install this latest version, run 'ghcup install ghc 9.10.1'
[ Info  ] verifying digest of: gs.exe
[ Info  ] downloading: https://downloads.haskell.org/~ghc/9.6.6/ghc-9.6.6-x86_64-unknown-mingw32.tar.xz as file C:\ghcup\tmp\ghcup-e2889c71bc9d3c01\ghc-9.6.6-x86_64-unknown-mingw32.tar.xz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  309M  100  309M    0     0  35.7M      0  0:00:08  0:00:08 --:--:-- 38.9M
[ Info  ] Unpacking: ghc-9.6.6-x86_64-unknown-mingw32.tar.xz to C:\ghcup\tmp\ghcup-ed464af51a8403e2
[ Info  ] Installing GHC (this may take a while)
[ Info  ] Merging file tree from "C:\ghcup\tmp\ghcup-ed464af51a8403e2\ghc-9.6.6-x86_64-unknown-mingw32" to "C:\ghcup\ghc\9.6.6-upstream"
[ Info  ] GHC installation successful

~ took 8m29s
➜ /c/ghcup/bin/ghc-9.6.6-upstream.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

Now I'm quite puzzled on what is going on with the 9.6.6-patched shim. I don't really understand what is going on here, check this:

➜ /c/ghcup/bin/ghc-9.6.6-upstream.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

~
❯ mv /c/ghcup/bin/ghc-9.6.6-patched.exe /c/ghcup/bin/ghc-9.6.6-back.exe

~
➜ cp /c/ghcup/bin/ghc-9.6.6-upstream.exe /c/ghcup/bin/ghc-9.6.6-patched.exe

~
➜ /c/ghcup/bin/ghc-9.6.6-patched.exe
zsh: permission denied: /c/ghcup/bin/ghc-9.6.6-patched.exe

jasagredo · 2024-11-12T07:30:30Z

Ok this is something I would not expect. If I get into PowerShell, I can try to execute both ghc-9.6.6-patched.exe and ghc-9.6.6-upstream.exe which are the same file as per the above sequence of commands. And I get this:

C:\ghcup\bin
➜ .\ghc-9.6.6-upstream.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

C:\ghcup\bin
➜ .\ghc-9.6.6-patched.exe

And the second one prompts a UAC dialog:

Which even if I click Yes, still has no output:

C:\ghcup\bin 
➜ .\ghc-9.6.6-patched.exe

C:\ghcup\bin
➜

jasagredo · 2024-11-12T07:35:17Z

Ok I think I have an answer and it is not what I was expecting:
https://stackoverflow.com/questions/20096706/how-does-windows-decide-whether-to-display-the-uac-prompt

Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:

Filename includes keywords like "install," "setup," "update," etc.

And my ghc has patched on its name. If I change it to ptched:

C:\ghcup\bin took 22s
➜ mv .\ghc-9.6.6-patched.exe .\ghc-9.6.6-ptched.exe

C:\ghcup\bin
❯ mv .\ghc-9.6.6-patched.shim .\ghc-9.6.6-ptched.shim

C:\ghcup\bin
➜ .\ghc-9.6.6-ptched.exe
ghc-9.6.6.exe: no input files
Usage: For basic information, try the `--help' option.

I guess this can close the issue as mystery solved. The issue is with the name of the file making it being considered an installer.

hasufell · 2024-11-13T04:44:37Z

If we have a more or less comprehensive list of these suffixes/filenames, I think it does make sense on windows to emit a post-install warning (or even pre-install with a 10s sleep timer) about this issue.

jasagredo · 2024-11-13T06:42:29Z

This only mentions "install", "setup" and "update", now we know also about "patch".

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#installer-detection-technology

jasagredo mentioned this issue Nov 11, 2024

Compiling HLS with custom bindist creates haskell-language-server-<ghcver>-<customtag>.exe shim and HLS fails #1150

Open

jasagredo closed this as completed Nov 12, 2024

hasufell reopened this Nov 13, 2024

hasufell added platform: windows type: improvement labels Nov 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Running custom bindist's shim requires elevated permissions on Windows #1149

Running custom bindist's shim requires elevated permissions on Windows #1149

jasagredo commented Nov 11, 2024 •

edited

Loading

hasufell commented Nov 11, 2024

jasagredo commented Nov 11, 2024 •

edited

Loading

hasufell commented Nov 11, 2024

jasagredo commented Nov 11, 2024

dfordivam commented Nov 12, 2024

jasagredo commented Nov 12, 2024

jasagredo commented Nov 12, 2024

jasagredo commented Nov 12, 2024

hasufell commented Nov 13, 2024

jasagredo commented Nov 13, 2024

Running custom bindist's shim requires elevated permissions on Windows #1149

Running custom bindist's shim requires elevated permissions on Windows #1149

Comments

jasagredo commented Nov 11, 2024 • edited Loading

hasufell commented Nov 11, 2024

jasagredo commented Nov 11, 2024 • edited Loading

hasufell commented Nov 11, 2024

jasagredo commented Nov 11, 2024

dfordivam commented Nov 12, 2024

jasagredo commented Nov 12, 2024

jasagredo commented Nov 12, 2024

jasagredo commented Nov 12, 2024

hasufell commented Nov 13, 2024

jasagredo commented Nov 13, 2024

jasagredo commented Nov 11, 2024 •

edited

Loading

jasagredo commented Nov 11, 2024 •

edited

Loading