Closed slonopotamus closed 2 years ago
This was very likely fixed by #13. Feel free to comment/reopen in case it wasn't.
Reopening, bug is still present. See #21
How to become SYSTEM: https://github.com/slonopotamus/stevedore/issues/21#issuecomment-1036236679
CreateUser: Error 0x800706ba: failed to create user: SYSTEM
and #21's logs show the next hurdle:
CreateUser: Error 0x80005000: Failed to add user Workgroup/SYSTEM to group 'WinNT://Localhost/docker-users'. CreateUser: Error 0x80005000: failed to add user: SYSTEM to group docker-users
I wonder if it's actually even possible to add SYSTEM
to a local group? https://superuser.com/a/1216142 suggests it's something special (not a normal user, nor a normal group) so maybe it needs to be specifically excepted from the 'add to docker-users' step. (Maybe there's a whole class of things that can be recognised this way? Other discussion on that superuser link and related links suggest that when pushed, it self-identifies as a group, rather than a user, except when it's the primary SID attached to a session, as is the case for psexec -s
and similar low-level system privileges.)
It's possible this is something the WIX code should actually recognise as impossible and deal with, e.g. document and skip.
I feel that in general, system accounts, e.g. System (aka LocalSystem), LocalService, NetworkService, etc. should not be being added to docker-users when they are running the installer. I'm not sure how that would be usefully distinguished off-hand, maybe there's an API to check this, or we could just check if the primary SID falls into the 'predefined SIDs' list.
Maybe in the end we just need an MSI option to skip the 'add users' step, that system administrators deploying via tools like Puppet or Salt can use, since they would presumably want to manage group membership through those tools anyway, e.g. adding "Interactive Users" to the docker-users group so that whoever happens to be logged in to that machine can use the local Docker instance.
Interestingly, the logs for #21 also show what might be a hideous bug in WIX:
RemoveUser: Error 0x800706ba: failed to delete user account: SYSTEM
i.e. rolling back the failed 'add user to group' (which has the 'create=false' flag so knows that it did not create this user) appears to have attempted to delete the user.
This would be 100% disastrous if it happened to a user account that could be deleted. It's trying to roll back an action it did not take, which seems pretty faulty to me.
Eww. Similar issue (no-op due to existing user rather than due to create=false) reported in 2005 and closed by timeout, never actually resolved.
Stevedore Sersion
0.0.2
Windows version
2019 LTSC
Log output
Additional context
Stevedore fails to install via Salt.