Incorrect NTFS File System Permissions

[FireDaemon]

Hello all,

I've built a regular MSI/EXE installer. It all works fine except the NTFS permissions are incorrect and not being inherited from the parent installation folder. What's odd about this is that I'm not explicitly specifying permissions on any file. In an attempt to debug this:

• I've turned on verbose logging: L*V logfile.txt - nothing meaningful in the FileCopy directive

• I've extracted the binaries from the installer (e.g. installer.exe /extract) and the perms on the EXE and DLL are as expected

• I've checked the binaries during install once the MSI is extracted into C:\Users\<user>\AppData\Roaming\<Company>\<Product>\install\<id>. Again perms are as expected

• I've run the installer across multiple machines and VMs and the perms are incorrect

The target installation folder has the following perms (via icacls):

Code: Select all

C:\Program Files\<Product>

                NT SERVICE\TrustedInstaller:(I)(F)
                NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                NT AUTHORITY\SYSTEM:(I)(F)
                NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                BUILTIN\Administrators:(I)(F)
                BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                BUILTIN\Users:(I)(RX)
                BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(I)(RX)
                APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

An EXE inside the folder has these incorrect, non-inherited permissions:

Code: Select all

            NT AUTHORITY\SYSTEM:(F)
            BUILTIN\Administrators:(F)
            <host>\<user>:(F)

The side effect of this is that non-admins cannot access the EXE and DLL. The perms should be:

Code: Select all

                  NT AUTHORITY\SYSTEM:(I)(F)
                  BUILTIN\Administrators:(I)(F)
                  BUILTIN\Users:(I)(RX)
                  APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                  APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APP PACKAGES:(I)(RX)

So how can I debug this to find out why the perms are being set incorrectly? Or what is setting the perms incorrectly?

Thanks in advance.

[Catalin]

Hey James and welcome to our forums,

Let's try to continue this over the email thread we already have going on.

This is currently under investigation on my end and I will followup as soon as I will have more information.

Best regards,
Catalin