Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Background

Most installation toolkits have the ability to launch, automatically or otherwise, external programs after installation. This is often appears in the installer via such options as "Show readme", or "Start program".

Issue

The problem is, many of these installers are poorly coded, and do not drop permissions appropriately. For example, starting the application automatically, or opening the application's homepage in the browser, often results in launching the application or browser with the installer's Administrative privileges, or a "High" UAC integrity level!

This has the potential to open up security breaches, by opening up the installed application, or a web page (and possibly browser add-ons), that are now running with elevated permissions.

(This is the reason I strongly recommend never choosing auto-launch options when installing software.)

Question

The question is: Is there a way to prevent certain applications (such as a web browser) from ever being launched with Administrative privileges, i.e., an automatic drop-privilege?

share|improve this question
1  
I really like this question. There are products to raise rights for processes based on path, hash, etc. I'd love to see something that drops rights automatically for, say, iexplore.exe, firefox.exe, chrome.exe, etc. –  Patrick S. Sep 9 '12 at 21:44
    
If the spawning program has admin rights, couldn't it just undo whatever you come up with and run it anyway? :) –  Ƭᴇcʜιᴇ007 Sep 9 '12 at 21:56
    
I guess it could, but I would be surprised if an installer was like, "Hey, you're gonna browse our home page as administrator, buddy!" and continually enforced those permissions. I don't think I'd buy software from a company like that, provided I could find out about it. –  Patrick S. Sep 9 '12 at 22:09
add comment

3 Answers 3

RUNAS /trustlevel: program

/trustlevel should be one of levels enumerated in /showtrustlevels. /showtrustlevels displays the trust levels that can be used as arguments to /trustlevel.

This requires an elevated command prompt.

-Explanation / Step by Step

  1. Open the start menu and type cmd on the search bar
  2. Right click on the command prompt and select run as administrator Type RUNAS /showtrustlevels
  3. Choose a trust level suitable for your application to run in Where X is the trust level you want to use
  4. Type RUNAS /trustlevel X "Application target"
share|improve this answer
    
I don't think this will work. In order to use RunAs to have the resulting browser window run with low rights, you would have to run the installer (via RunAs) with low rights. Doing so would likely cause the installer not to work. –  Patrick S. Sep 9 '12 at 21:42
    
well if you wanted to do it that way you would change the environment variable for your browser to include the RUNAS /trustlevel command then the browser will always launch in the selected trust level, its unlikely that you would need to ever run the browser in an elevated situation... worth a thought –  David McGowan Sep 10 '12 at 0:27
    
Can you explain or update your answer? I don't mean to hijack this question, but I'd love to know the same thing as the OP. –  Patrick S. Sep 10 '12 at 1:18
    
Changing the environment variable is a bit of a mission, its going to require creating a simple exe to replace the original that contains a simple call to the real executable with the RUNAS command included. like i said, bit of a mission you could just copy the address that the browser window launches with and then close and relaunch the browser and type the address in –  David McGowan Sep 10 '12 at 15:58
add comment

You should be able to achieve the lower rights level with either dropmyrights or psexec.

The tricky part seems to be in making it happen automatically when an installer spawns a new instance of the application.

For that I suspect you will at least need to tweak the file associations for all relevant file types and also for URLs, prepending your existing command with the psexec command for example.

That will work as long as the installer tries to open the file/url with the associated application rather than specifying the executable to run. If the executable path is specified explicitly I guess you would need to replace the standard executable with a shim executable which runs the command you want.

share|improve this answer
add comment

i looked into different solutions and i can already tell you that application manifests or appcompat flags won't work (yes thats no real answer but i still wanted to share this ;))

what might be close to what you are looking for is the so called integrity level, it can be set within the filesystem (ACL) and has an effect on the token the process is holding

this article explains how you make an exe always run at "low integrity level"

another aproach would be a third party tool, like a real-time process monitor a virus scanner or application firewall would use, but i don't know of any that can be configured that way.

share|improve this answer
    
you can ignore my answer, i just tried that method and it didn't work :( –  weberik Apr 7 at 15:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.