No UAC prompt

[brunovieira97]

Description of the new feature/enhancement

Don't show a UAC prompt if installation of software is being done through WinGet. Much like as it's possible with Scoop.

[Stanzilla]

That only works because scoop does not install to Program Files

[dhrrgn]

This seems like it would create some security nightmares. Since the install commands can be ran from a script, it would be fairly simple to exploit that. Maybe if they added a flag, that somehow only worked when ran directly from the shell...but even that could be worked around in all likelihood.

[JoBrad]

Scoop does this perfectly, actually. It installs the portable version of the apps, and uses symlinks to point to the current version, your app config, and a common bin folder. So you don’t have to add as many paths to your PATH variable (you still do, but not as often).

[Nowaker]

That only works because scoop does not install to Program Files

Great idea, let's NOT install to Program Files!

[tresf]

This seems like it would create some security nightmares

As others have indicated, it's not a security issue, the apps are coerced to install to user space through various methods (Portable apps or 7zip extraction combined with manual user-space registration, etc).

[Calinou]

For the record, Electron apps' installers will often install to %LOCALAPPDATA% to avoid UAC prompts. That path is generally considered the standard location for user-wide program installation.

I'd be surprised if Microsoft changes the default path to an user-wide location, but maybe an --user option can be added to install applications on an user-wide basis. This is what Flatpak does, for instance.

[gerardog]

I think we all agree "No UAC prompt" does not work for system-wide installs. If it affects other users, elevation is required.

So, "no UAC" only works for current-user-only installs. But does WinGet install to current-user or does system-wide installs?
Correct me if I am wrong, but I think it actually depends on the app manifest that WinGet just executes. I wasn't even able to find documentation about how your app should be packaged for user/system scenarios. So was this planned? Or MS just let each app installer to behave differently? This looks messy.

Of course it should have --user / --system flags.

I propose this and #271 are closed in favor of a System install VS User Install mode. Which just found out is already /dupe #281

[brunovieira97]

I believe that the best approach would be user-only installs by default, with a --global npm-like switch, so we can install that particular app system-wide. Once again, Scoop does exactly this.

The most important thing is consistency. There must be a default behavior that every manifest installation shall follow, and a switch or parameter so we can specify a different one.

[dmex]

the best approach would be user-only installs by default

User-only installations create security issues with binary planting/hijacking attacks. It could be an optional feature but most definitely not the default option.

[brunovieira97]

User-only installations create security issues with binary planting/hijacking attacks.

I highly doubt this is a security concern for the everyday user. If so, various apps that are currently installed on user level (such as VS Code) would never be advised as so by Microsoft. The main users of package managers will, undoubtedly, be developers.

UAC at every install is a workflow-killer, needing additional interaction when I'm already passing a full command on my terminal with (what should be considered as) all needed information for installing a particular software.

[dmex]

various apps that are currently installed on user level (such as VS Code) would never be advised as so by Microsoft.

vscode doesn't install a kernel driver like the itunes, hwmonitor, cpuz, nmap and other current winget packages do currently and so the attack vectors when executing vscode from user writable folders are limited in comparison to executing kernel driver/applications from user writable folders.

If winget auto-elevated the package installations an attacker will execute winget to install vulnerable versions of a package and exploit the automatically installed kernel driver to elevate privileges to administrator and compromise the machine and use those administrative credentials to compromise the entire corporate network - lateral movement with PsExec launching winget.

UAC at every install is a workflow-killer, needing additional interaction when I'm already passing a full command on my terminal

You're always going to see a prompt unless you disable UAC.

It is possible for winget packages to include a "requires admin" flag and before installation winget prompt to elevate itself and continue the installations for those packages as administrator. This would negate the attack vector from automatic elevation and reduce multiple prompts to a single prompt but you would still see the one prompt and winget would need to allow installing multiple packages with one command.

[tresf]

install a kernel driver like the itunes, hwmonitor, cpuz, nmap and other current winget packages

I feel like this project is trying to be both a deployment tool and a package manager at the same time and these arguments won't ever end.

The user-space installs are recommended for those that can be installed in user space. Perhaps the compromise is for Windows to add a sudo-like command to the OS (not runas) but to make claim user-scope-by-default is bad seems short sighted. The security is improved when kernel-mode drivers take a back seat to the apps that don't need this type of access. Lowest privilege is often preferred for security reasons. If this tool only aims to be a wrapper around the Windows store, no one except Windows administrators will use it. The audience for this type of tool is much larger if done correctly.

Just setting up cmake, maven or ant is tedious on Windows. These types of things don't need UAC or administrator access to be installed yet are available in every package manager (brew, apt, pacman). Heck, even Solaris can install them.

[aetos382]

Winget should not (as scoop does) extract files from installer packages (such as exe or msi) and place them in user space in such a way that the application provider does not support them, to avoid UAC prompts.