Re: grub tools and Windows UAC

[Andrey Borzenkov <arvidjaar@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1534 bytes --]

В Ср, 25/12/2013 в 13:16 +0100, Vladimir 'φ-coder/phcoder' Serbinenko
пишет:
> On 25.12.2013 12:11, Andrey Borzenkov wrote:
> > If UAC is enabled, running grub-install (and probably others too - did
> > not try) will request privilege elevation; but then process is
> > re-launched in separate window and disappears after it is finished.
> > This makes even reading help impossible.
> I think that the cause of it is get_default_platform which uses
> get_efi_variable to check for EFI. Perhaps we should check privileges
> and assume BIOS if get_default_platform is run just for the help.
> > 

It turned out to be completely unrelated. In its infinite wisdom Windows
assumes that if program has "install" or "setup" in its name, it
requires privileges elevation. Just try to run grub-bios-setup.exe :)

I did not find how to prevent it. The only suggestion is to create
manifest, but it has somewhat interesting effect - adding manifest with
level="asInvoker" does not stop Windows from attempting elevation but
now blocks attempt. So program immediately terminates with Access
Denied. And it results in nagging window about unsigned application (may
be signed applications would behave differently).

It is possible to set environment variable __compat_layer to
RunAsInvoker, but it must be done *before* starting process and is
outside of grub control.

Unless someone with better Windows experience can offer solution I'm
afraid we have to live with it. Or rename these programs on Windows.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]