Issue: Failed to load the hostfxr.dll, when PowerShell installed via Microsoft Store

[jetersen]

Issue Description

sudo fails loading dll in net5 / powershell 7.1

❯ sudo
Failed to load the dll from [C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\hostfxr.dll], HRESULT: 0x80070005
The library hostfxr.dll was found, but loading it from C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\hostfxr.dll failed
  - Installing .NET prerequisites might help resolve this problem.
     https://go.microsoft.com/fwlink/?linkid=798306
Info: Process exited with code -2147450750

Steps to Reproduce

1. Launch powershell 7
2. sudo

Screenshots

Context:

• Windows version: 20H2
• gsudo version: v0.7.2

[gerardog]

Hi!
Have you tried running powershell as admin the regular way? Does it work?
Have you tried 'gsudo' instead of 'sudo'?
Also, could you please use cmd instead of pwsh, then gsudo, and then run Pwsh?

Thanks.-

[jetersen]

This is specfially only affected by powershell 7.1

gsudo or sudo makes no difference.
launching cmd and than gsudo than pwsh works but of course it should.

[gerardog]

I was not able to reproduce it.

Try gsudo -v and paste here to see if something unusual appears.

[gerardog]

Sorry, I meant gsudo --debug. my bad

[jetersen]

I installed powershell via microsoft store.

[jetersen]

gsudo --debug
Debug: IsWindowsApp(""C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\pwsh.exe"") = False ("C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\pwsh.exe")
Debug: Command to run: "C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\pwsh.exe" -NoLogo
Debug: Using Console mode TokenSwitch
Debug: Caller PID: 11072
Debug: Caller SID: S-1-5-21-844353533-2438578127-226963234-1001
Debug: Elevating process: C:\ProgramData\chocolatey\lib\gsudo\bin\gsudo.exe --debug gsudoservice 11072 S-1-5-21-844353533-2438578127-226963234-1001 All 00:05:00
Debug: Elevated instance started.
Debug: Connected via Named Pipe ProtectedPrefix\Administrators\gsudo_20D9743E1B5E7F1D161FA1AF7E00C965A5510B2D56E4CCC637ABC513E1C23F9A.
Debug: CreateProcessAsUser: "C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\pwsh.exe" -NoLogo
Debug: ElevationRequest length 850
Debug: Process token successfully substituted.
Failed to load the dll from [C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\hostfxr.dll], HRESULT: 0x80070005
The library hostfxr.dll was found, but loading it from C:\Program Files\WindowsApps\Microsoft.PowerShell_7.1.0.0_x64__8wekyb3d8bbwe\hostfxr.dll failed
  - Installing .NET prerequisites might help resolve this problem.
     https://go.microsoft.com/fwlink/?linkid=798306
Info: Process exited with code -2147450750

service:

Info: Service started
Debug: Service will shutdown if idle for 00:05:00
Debug: Listening on named pipe ProtectedPrefix\Administrators\gsudo_20D9743E1B5E7F1D161FA1AF7E00C965A5510B2D56E4CCC637ABC513E1C23F9A.
Debug: Access allowed only for ProcessID 11072 and children
Debug: NamedPipeServer listening.
Info: Incoming Connection.
Debug: ElevationRequest length 850
Debug: NtSetInformationProcess returned 0
Info: Connection Closed.
Debug: NamedPipeServer listening.

[gerardog]

After installing from the Microsoft Store, I can see this problem as well.
I've seen that some apps don't work well when its process token is replaced by the Token Switch mode.

whoami.exe is one of them. Wasn't able to find a proper fix for that, but a workaround: That's why when you gsudo whoami from cmd, it actually runs cmd /c whoami instead of just "elevating" whoami.exe.
But this is a first time the shell itself fails this way, and super weird it only happens when installed from the Ms Store.

Workarounds:

• gsudo --attached will fallback to Attached Mode, and works. But you will have other issues if you try to capture the output as in '$result = gsudo get-item abc'
• Install PowerShell using choco install powershell-core, or via scoop, or download the release from github.

Some research is needed for a proper fix. Knowing why hostfxr.dll fails to load, for example.

[gerardog]

If --attached is annoying, gsudo config ForceAttachedConsole True will remind it.

[gerardog]

Attached Mode has issues with Ctrl-C

[jetersen]

Maybe it would be good idea to open an issue on the powershell repo?

[gerardog]

Help would 100% be appreciated... But If we can't reproduce this issue without gsudo being involved, I fear the issue will be shut-down.
The thing is Token Switch mode, which is great because allows lots of gsudo functionality, uses undocumented windows API's that are unsupported. So this is probably not a Pwsh.exe issue.

This is what I see with SysInternals Process Monitor:

Process Name: pwsh.exe
Operation: CreateFile
Result: ACCESS DENIED
Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a

It might be related with the fact that UWP apps (eg. Microsoft Store) installs into C:\Program Files\WindowsApps, and that folder has special permissions set.

What is that condition? The execute permission is conditional? Where is WIN://SYSAPPID stored and can it be lost when gsudo service replaces the process token.. ?

[gerardog]

It seems that CreateProcess manipulates the process token when launching Microsoft Store Apps, adding the WIN://SYSAPPID attribute. When gsudo replaces the token, the app fails to load. So the final call to CreateProcess(pwsh.exe) needs to be elevated beforehand.

So I've crafted a not-ideal solution, that seems to be working... What I did was to elevate a non-microsoft-store wrapper (CMD.EXE) and then CreateProcess(pwsh.exe)

Or simply put... gsudo will elevate CMD /c Pwsh.exe instead of pwsh.exe directly when pwsh.exe is located in WindowsApps folder... 😳

Could you please @jetersen, and others having this issue, please help me test this fix?

Here is a fix build, (not digitally signed. sorry): https://ci.appveyor.com/project/gerardog/gsudo/builds/36455864/artifacts

[gerardog]

It wasnt working from CMD if you gsudo pwsh . So try this fix instead

[jetersen]

Tested the latest fix, which works for me.