Describe the bug
Non-administrators (Users group) other than the administrator who installed an extension cannot use the extension installed with --system option introduced at Azure CLI version 2.6.0.
To Reproduce
Install Azure CLI 2.6.0.
Run command prompt as administrator.
Install an extension with --system option. (ex. az extension add --name azure-devops --system)
Switch to another user who is not in the Administrators group.
Run any command provided by the extension installed by the step 3. (ex. az devops -h) Then, you’ll see that Azure CLI could not find the extension.
Check access permission for extension directory and its sub directory. Then, you’ll see that permissions for sub directories of extensions’ directories are missing as below.
C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops>icacls .
. NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX) -- sub directories does not inherit this permission, and uses cannot access files Azure CLI need to access.
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops\azext_devops>icacls .
. NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
DESKTOP-KMBUKNF\Administrator:(OI)(CI)(F)
Expected behavior
Non-administrators (Users group) other than the administrator who installed an extension can use the extension installed with --system option.
Also, I think that sub directories of extensions’ directories should inherit permission from parent directory (extension directory).
Environment summary
Azure CLI 2.6.0 on windows 10
Additional context
Workaround I found so far
Grant permissions to the following folders under C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops.
azext_devops
azure_devops-0.18.0.dist-info
Properties -> Security tab -> Advanced -> Enable inheritance -> Press OK button
Again, run any command provided by the extension installed by the step 3. (ex. az devops -h) You can see that the command was executed successfully.
Describe the bug Non-administrators (Users group) other than the administrator who installed an extension cannot use the extension installed with --system option introduced at Azure CLI version 2.6.0.
To Reproduce
C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops>icacls . . NT SERVICE\TrustedInstaller:(I)(F) NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) BUILTIN\Users:(I)(RX) -- sub directories does not inherit this permission, and uses cannot access files Azure CLI need to access. BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(I)(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops\azext_devops>icacls . . NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) DESKTOP-KMBUKNF\Administrator:(OI)(CI)(F)
Expected behavior Non-administrators (Users group) other than the administrator who installed an extension can use the extension installed with --system option. Also, I think that sub directories of extensions’ directories should inherit permission from parent directory (extension directory).
Environment summary Azure CLI 2.6.0 on windows 10
Additional context Workaround I found so far Grant permissions to the following folders under C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure-cli-extensions\azure-devops.