Calling some functions without admin-rights leads to unpredictable behaviour
we-mi opened this issue · comments
Describe the bug
Some actions of choco.exe needs admin-privileges to function normally.
If you do not have them you get a warning and can choose to continue anyway. The dialog times out after 20 seconds and defaults to 'N' (Not proceed).
The output of some ChocoMan-functions are unpredicatable, because the output cannot be parsed, so in the end you don't know if the commands were executed properly or not.
To Reproduce
Steps to reproduce the behavior:
- Start powershell without administrator privileges
- Execute
Install-ChocoPackage -Name openscad - Wait at least 20 seconds
- See output from function, like:
> Install-ChocoPackage "openscad"
Name Status Version
---- ------ -------
openscad
Expected behavior
The affected ChocoMan-Functions should give a warning that they are not started with the needed priviliges.
Additional context
The output from the commands are different. It depends on what function is used and if the package is already installed or not.
One could use choco.exe without admin-privileges but this does not work for every package.
choco.exe checks if the Tag admin is present for the package and gives the above warning.
If the Tag is not present it just continues with the package installation/uninstallation/upgrade, but it depends on the package if this succeeds (maybe installing software in the users home directory)
This is also applicable for changing sources.
The above warning can not be seen when calling choco.exe with Invoke-ChocoCmd because it redirects all output to a variable.
You can only see it when calling choco.exe directly.
The warning is:
Chocolatey detected you are not running from an elevated command shell
(cmd/powershell).
You may experience errors - many functions/packages
require admin rights. Only advanced users should run choco w/out an
elevated shell. When you open the command shell, you should ensure
that you do so with "Run as Administrator" selected. If you are
attempting to use Chocolatey in a non-administrator setting, you
must select a different location other than the default install
location. See
https://docs.chocolatey.org/en-us/choco/setup#non-administrative-install
for details.
For the question below, you have 20 seconds to make a selection.
Do you want to continue?([Y]es/[N]o):
@we-mi You mentioned an admin Tag for packages. I do not see that when listing all of them.
Do you know how I can get the package Tag?
Hey @regg00,
Sorry, my bad. You're completly right.
I've read somewhere that the admin-tag tells choco that administrative permissions are required, but this seems to be not true.
The admin-tag should be used for packages when an administrative helper-function is being used (see here).
The decision to show the warning about missing privileges is most likely tested by some other rules, which I sadly don't know.
My suggestion for this issue is to implement/show a preceding warning by your own functions and then exit the function without actually calling choco.exe unless the -Force (or another) parameter is specified in case the user knows what he's doing and tries to install/uninstall anything for which he doesn't need admin privileges for.
Nice to know I didn't miss something in the chocolatey doc.
Your suggestion make total sense.
I played a bit with #Requires -RunAsAdministrator for only some functions, but it makes the module a bit cumbersome to install for some reason, specifically if not all the commands require you to be an admin.
Having a function that checks if a user is an admin before actually running the choco command makes total sense. Something like: ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") should return True or False depending if the user is an admin or not.
I simply added a check at every Admin function.
I couldn't find a parameter that allowed me to bypass the choco.exe Yes/No prompt
PS C:\Users\regg0\GitHub\ChocoMan> choco apikey -s=https://google.com -k=123
Chocolatey v2.1.0 Business
API key provided. Setting command to add.
Chocolatey detected you are not running from an elevated command shell
(cmd/powershell).
You may experience errors - many functions/packages
require admin rights. Only advanced users should run choco w/out an
elevated shell. When you open the command shell, you should ensure
that you do so with "Run as Administrator" selected. If you are
attempting to use Chocolatey in a non-administrator setting, you
must select a different location other than the default install
location. See
https://docs.chocolatey.org/en-us/choco/setup#non-administrative-install
for details.
Do you want to continue?([Y]es/[N]o): n
PS C:\Users\regg0\GitHub\ChocoMan> choco apikey -s=https://google.com -k=123 -f -y
Chocolatey v2.1.0 Business
API key provided. Setting command to add.
Chocolatey detected you are not running from an elevated command shell
(cmd/powershell).
You may experience errors - many functions/packages
require admin rights. Only advanced users should run choco w/out an
elevated shell. When you open the command shell, you should ensure
that you do so with "Run as Administrator" selected. If you are
attempting to use Chocolatey in a non-administrator setting, you
must select a different location other than the default install
location. See
https://docs.chocolatey.org/en-us/choco/setup#non-administrative-install
for details.
For the question below, you have 20 seconds to make a selection.
Do you want to continue?([Y]es/[N]o): n
PS C:\Users\regg0\GitHub\ChocoMan> choco apikey -s=https://google.com -k=123 -f -y -r --limit-output
API key provided. Setting command to add.
Chocolatey detected you are not running from an elevated command shell
(cmd/powershell).
You may experience errors - many functions/packages
require admin rights. Only advanced users should run choco w/out an
elevated shell. When you open the command shell, you should ensure
that you do so with "Run as Administrator" selected. If you are
attempting to use Chocolatey in a non-administrator setting, you
must select a different location other than the default install
location. See
https://docs.chocolatey.org/en-us/choco/setup#non-administrative-install
for details.
For the question below, you have 20 seconds to make a selection.
Do you want to continue?([Y]es/[N]o): n