BUG #18615: installer cannot be executed as "nt-autorität\system"

On Thu, Sep 12, 2024 at 4:19 PM PG Bug reporting form <
noreply@postgresql.org> wrote:

The following bug has been logged on the website:

Bug reference: 18615
Logged by: neeral85
Email address: neral85@gmx.de
PostgreSQL version: 16.4
Operating system: Windows x64
Description:

16.2 could be executed as "nt-autorität\system" while 16.4 cannot be
executed as "nt-autorität\system"

This is required by patch management software as it runs any installation
as
"nt-autorität\system" and not with current login user.
----------
Log started 09/12/2024 at 12:23:00
Preferred installation mode : unattended
Trying to init installer in mode unattended
Mode unattended successfully initialized
Setting variable whoami from C:\Windows\System32\whoami
Script exit code: 0

Script output:
nt-autorität\system

Script stderr:

Error copying file from packed archive
C:/Users/User/tmp/postgresql-16.4-1-windows-x64.exe to
C:/Windows/Temp/postgresql_installer_a27c6b7106/prerun_checks.vbs
:Destination not writable
system's temp folder is not writable by the current user.
Exiting with code 1
------

Hi,

Maybe "nt-autorität\system" user doesn't have the write permission for the
"C:/Windows/Temp/" folder.
Can you please run the below icacls command and share the output.

icacls c:\Windows\Temp

PS C:\> icacls c:\Windows\Temp
c:\Windows\Temp VORDEFINIERT\Benutzer:(CI)(S,WD,AD,X)

VORDEFINIERT\Administratoren:(F)

VORDEFINIERT\Administratoren:(OI)(CI)(IO)(F)

NT-AUTORITÄT\SYSTEM:(F)

NT-AUTORITÄT\SYSTEM:(OI)(CI)(IO)(F)

ERSTELLER-BESITZER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

PS C:\>

It looks like installer does set incorrect permissions for its temp folder in c:\Windows\Temp\. I can see the folder, e.g. C:\Windows\Temp \postgresql_installer_3086eea437.

PS C:\> icacls C:\Windows\Temp\postgresql_installer_3086eea437\

C:\Windows\Temp\postgresql_installer_3086eea437\DEVICENAME$:(F)

It should inherit permission from c:\Windows\Temp\.

Von: Muralikrishna Bandaru <muralikrishna.bandaru@enterprisedb.com>
Gesendet: Mittwoch, 18. September 2024 14:58
An: neral85@gmx.de; pgsql-bugs@lists.postgresql.org
Betreff: Re: BUG #18615: installer cannot be executed as "nt-autorität\system"

On Thu, Sep 12, 2024 at 4:19 PM PG Bug reporting form <noreply@postgresql.org <mailto:noreply@postgresql.org> > wrote:

The following bug has been logged on the website:

Bug reference: 18615
Logged by: neeral85
Email address: neral85@gmx.de <mailto:neral85@gmx.de>
PostgreSQL version: 16.4
Operating system: Windows x64
Description:

16.2 could be executed as "nt-autorität\system" while 16.4 cannot be
executed as "nt-autorität\system"

This is required by patch management software as it runs any installation as
"nt-autorität\system" and not with current login user.
----------
Log started 09/12/2024 at 12:23:00
Preferred installation mode : unattended
Trying to init installer in mode unattended
Mode unattended successfully initialized
Setting variable whoami from C:\Windows\System32\whoami
Script exit code: 0

Script output:
nt-autorität\system

Script stderr:

Error copying file from packed archive
C:/Users/User/tmp/postgresql-16.4-1-windows-x64.exe to
C:/Windows/Temp/postgresql_installer_a27c6b7106/prerun_checks.vbs
:Destination not writable
system's temp folder is not writable by the current user.
Exiting with code 1
------

Hi,

Maybe "nt-autorität\system" user doesn't have the write permission for the "C:/Windows/Temp/" folder.
Can you please run the below icacls command and share the output.

icacls c:\Windows\Temp

On Sat, Sep 21, 2024 at 3:21 PM <neral85@gmx.de> wrote:

PS C:\> icacls c:\Windows\Temp
c:\Windows\Temp VORDEFINIERT\Benutzer:(CI)(S,WD,AD,X)

VORDEFINIERT\Administratoren:(F)

VORDEFINIERT\Administratoren:(OI)(CI)(IO)(F)

NT-AUTORITÄT\SYSTEM:(F)

NT-AUTORITÄT\SYSTEM:(OI)(CI)(IO)(F)

ERSTELLER-BESITZER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

PS C:\>

It looks like installer does set incorrect permissions for its temp folder
in c:\Windows\Temp\. I can see the folder, e.g. C:\Windows\Temp
\postgresql_installer_3086eea437.

PS C:\> icacls C:\Windows\Temp\postgresql_installer_3086eea437\

C:\Windows\Temp\postgresql_installer_3086eea437\DEVICENAME$:(F)

It should inherit permission from c:\Windows\Temp\.

Hi,
Installer has some checks to handle "nt authority\system" users and your
system instead has “nt-autorität\system”.
I'm unable to reproduce the issue as I have "nt authority\system" user.
Right now I'm not sure how to handle the “nt-autorität\system” user. I will
look for the possibilities.

On Tue, Sep 24, 2024 at 11:52 AM Muralikrishna Bandaru <
muralikrishna.bandaru@enterprisedb.com> wrote:

On Sat, Sep 21, 2024 at 3:21 PM <neral85@gmx.de> wrote:

PS C:\> icacls c:\Windows\Temp
c:\Windows\Temp VORDEFINIERT\Benutzer:(CI)(S,WD,AD,X)

VORDEFINIERT\Administratoren:(F)

VORDEFINIERT\Administratoren:(OI)(CI)(IO)(F)

NT-AUTORITÄT\SYSTEM:(F)

NT-AUTORITÄT\SYSTEM:(OI)(CI)(IO)(F)

ERSTELLER-BESITZER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

PS C:\>

It looks like installer does set incorrect permissions for its temp
folder in c:\Windows\Temp\. I can see the folder, e.g. C:\Windows\Temp
\postgresql_installer_3086eea437.

PS C:\> icacls C:\Windows\Temp\postgresql_installer_3086eea437\

C:\Windows\Temp\postgresql_installer_3086eea437\DEVICENAME$:(F)

It should inherit permission from c:\Windows\Temp\.

Hi,
Installer has some checks to handle "nt authority\system" users and your
system instead has “nt-autorität\system”.
I'm unable to reproduce the issue as I have "nt authority\system" user.
Right now I'm not sure how to handle the “nt-autorität\system” user. I
will look for the possibilities.

Hi,
Can you please share the SID of “nt-autorität\system” user using the "*whoami
/user*" command.

Hello,

that is because of German OS.

C:\>whoami /user

BENUTZERINFORMATIONEN

---------------------

Benutzername SID

=================== ========

nt-autorität\system S-1-5-18

C:\>

Hi,

Installer has some checks to handle "nt authority\system" users and your system instead has “nt-autorität\system”.

I'm unable to reproduce the issue as I have "nt authority\system" user. Right now I'm not sure how to handle the “nt-autorität\system” user. I will look for the possibilities.

Hi,

Can you please share the SID of “nt-autorität\system” user using the "whoami /user" command.