Skip to content
Permalink
Browse files Browse the repository at this point in the history
Add NSIS AccessControl plugin to set permissions on install dir
From https://nsis.sourceforge.io/AccessControl_plug-in adding ANSI version (i386) since that's we are using for now.
  • Loading branch information
chadlwilson committed May 17, 2022
1 parent a536df0 commit 96add96
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 0 deletions.
17 changes: 17 additions & 0 deletions installers/windows/go-base.nsi
Expand Up @@ -152,6 +152,21 @@ Function ".onInit"
${LogSet} off
FunctionEnd

Function "SetupDirectoryPermissions"
${LogText} "Setting directory permissions..."

; Disable inheritance. This breaks the inheritance chain and turns inherited permissions into explicit ones.
AccessControl::DisableFileInheritance $INSTDIR
; Make Administrators the owner
AccessControl::SetFileOwner $INSTDIR "(S-1-5-32-544)"
; Clear all explicit permissions on the file, leaving Administrators with full access
AccessControl::ClearOnFile $INSTDIR "(S-1-5-32-544)" "FullAccess"
; Give SYSTEM full access.
AccessControl::SetOnFile $INSTDIR "(S-1-5-18)" "FullAccess"
; Give Everyone only access to read, list dir, and execute.
AccessControl::SetOnFile $INSTDIR "(S-1-1-0)" "GenericRead + GenericExecute + ListDirectory + ReadAttributes"
FunctionEnd

; This section (being the first one, not because it's called Install) will be executed after the `.onInit` callback
Section "Install"
SectionIn RO
Expand All @@ -160,6 +175,8 @@ Section "Install"
SetOutPath $INSTDIR
${LogSet} on

Call SetupDirectoryPermissions

${If} $IsUpgrading == "true"
${LogText} "Performing an upgrade"
Call BeforeUpgrade
Expand Down
Binary file added installers/windows/nsis-plugins/AccessControl.dll
Binary file not shown.

0 comments on commit 96add96

Please sign in to comment.