Skip to content

Commit a2476da

Browse files
g-bougardg-bougard
committed
build: Fix condition to run SchedSecureObjects action for MSI build
Fix windows system folder for commands to use in MSI custom actions Fix wrong check on local folder security fix
1 parent 7d37cf6 commit a2476da

File tree

2 files changed

+68
-15
lines changed

2 files changed

+68
-15
lines changed

‎Changes

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ Revision history for GLPI agent
33
1.7.3 not yet released
44

55
packaging:
6-
* Fix LOCAL is set to installation folder when LOCAL is not used on MSI windows
7-
installation, and even if it was set empty in installer UI
8-
* Enhanced CVE-2024-28241 fix to only apply folder security if folder is not a
9-
subfolder of system "Program Files" folder
6+
* Fix LOCAL was set to installation folder during windows MSI installation v1.7.2,
7+
even if LOCAL was not used or it was set empty in installer UI
8+
* Enhanced CVE-2024-28241 fix to only apply folder security if install folder and
9+
eventually LOCAL folder are subfolders of system "Program Files" folder
1010

1111
1.7.2 Mon, 25 Mar 2024
1212

‎contrib/windows/packaging/MSI_main-v2.wxs.tt

+64-11
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@
9595
<RegistrySearch Id="Local" Root="HKLM" Key="[%agent_regpath%]" Name="local" Type="raw"/>
9696
</Property>
9797
<SetProperty Id="CMDLINE_LOCAL" Before="AppSearch" Value="[LOCAL]" />
98-
<!-- Also compare to ProgramFiles64Folder to fix wrongly set LOCAL in 1.7.2 -->
98+
<!-- Also compare to INSTALLDIR to fix wrongly set LOCAL in 1.7.2 -->
9999
<SetProperty Id="LOCAL" After="AppSearch" Value="[CMDLINE_LOCAL]"><![CDATA[CMDLINE_LOCAL<>"" OR LOCAL=INSTALLDIR OR CMDLINE_CONFIG="reset"]]></SetProperty>
100100
<SetDirectory Id="_LOCALDIR" Before="CostFinalize" Value="[LOCAL]" />
101101

@@ -407,41 +407,94 @@
407407
<CustomAction Id="SetDefaultLogFile" Property="LOGFILE" Value="[INSTALLDIR]logs\glpi-agent.log" Execute="firstSequence" />
408408
<CustomAction Id="SetDefaultVarDir" Property="VARDIR" Value="[INSTALLDIR]var" Execute="firstSequence" />
409409

410+
[%- IF bits==32 %]
410411
<CustomAction Id="SetDeleteFirewallExceptionCmd" Property="DeleteFirewallException" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;!(loc.FirewallExceptionName)&quot;" Execute="immediate" />
412+
[%- ELSE %]
413+
<CustomAction Id="SetDeleteFirewallExceptionCmd" Property="DeleteFirewallException" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;!(loc.FirewallExceptionName)&quot;" Execute="immediate" />
414+
[%- END %]
411415
<CustomAction Id="DeleteFirewallException" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
416+
[%- IF bits==32 %]
412417
<CustomAction Id="SetAddFirewallExceptionInCmd" Property="AddFirewallExceptionIn" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall add rule name=&quot;!(loc.FirewallExceptionName)&quot; program=&quot;[#f_agent_exe]&quot; description=&quot;!(loc.FirewallExceptionDescription)&quot; protocol=TCP dir=in localport=[HTTPD_PORT] action=allow" Execute="immediate" />
418+
[%- ELSE %]
419+
<CustomAction Id="SetAddFirewallExceptionInCmd" Property="AddFirewallExceptionIn" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall add rule name=&quot;!(loc.FirewallExceptionName)&quot; program=&quot;[#f_agent_exe]&quot; description=&quot;!(loc.FirewallExceptionDescription)&quot; protocol=TCP dir=in localport=[HTTPD_PORT] action=allow" Execute="immediate" />
420+
[%- END %]
413421
<CustomAction Id="AddFirewallExceptionIn" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
422+
[%- IF bits==32 %]
414423
<CustomAction Id="SetAddFirewallExceptionOutCmd" Property="AddFirewallExceptionOut" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall add rule name=&quot;!(loc.FirewallExceptionName)&quot; program=&quot;[#f_agent_exe]&quot; description=&quot;!(loc.OutgoingFirewallExceptionDescription)&quot; dir=out action=allow" Execute="immediate" />
424+
[%- ELSE %]
425+
<CustomAction Id="SetAddFirewallExceptionOutCmd" Property="AddFirewallExceptionOut" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall add rule name=&quot;!(loc.FirewallExceptionName)&quot; program=&quot;[#f_agent_exe]&quot; description=&quot;!(loc.OutgoingFirewallExceptionDescription)&quot; dir=out action=allow" Execute="immediate" />
426+
[%- END %]
415427
<CustomAction Id="AddFirewallExceptionOut" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
416428

417429
<!-- GLPI Agent 1.0 to 1.2 installers was creating wrongly named firewall rules, prepare CustomAction to clean up them -->
430+
[%- IF bits==32 %]
418431
<CustomAction Id="SetDeleteWrongFirewallRuleInCmd" Property="DeleteFirewallWrongIn" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=description= embedded HTTP server incoming traffic&quot;" Execute="immediate" />
432+
[%- ELSE %]
433+
<CustomAction Id="SetDeleteWrongFirewallRuleInCmd" Property="DeleteFirewallWrongIn" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=description= embedded HTTP server incoming traffic&quot;" Execute="immediate" />
434+
[%- END %]
419435
<CustomAction Id="DeleteFirewallWrongIn" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
436+
[%- IF bits==32 %]
420437
<CustomAction Id="SetDeleteWrongFirewallRuleOutCmd" Property="DeleteFirewallWrongOut" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=description= outgoing traffic&quot;" Execute="immediate" />
438+
[%- ELSE %]
439+
<CustomAction Id="SetDeleteWrongFirewallRuleOutCmd" Property="DeleteFirewallWrongOut" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=description= outgoing traffic&quot;" Execute="immediate" />
440+
[%- END %]
421441
<CustomAction Id="DeleteFirewallWrongOut" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
442+
[%- IF bits==32 %]
422443
<CustomAction Id="SetDeleteWrongFirewallRuleExeCmd" Property="DeleteFirewallWrongExe" Value="&quot;[SystemFolder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=[#f_agent_exe]&quot;" Execute="immediate" />
444+
[%- ELSE %]
445+
<CustomAction Id="SetDeleteWrongFirewallRuleExeCmd" Property="DeleteFirewallWrongExe" Value="&quot;[System64Folder]netsh.exe&quot; advfirewall firewall delete rule name=&quot;program=[#f_agent_exe]&quot;" Execute="immediate" />
446+
[%- END %]
423447
<CustomAction Id="DeleteFirewallWrongExe" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
424448

425449
<CustomAction Id="SetForceRun" Property="ForceRun" Value="&quot;[#f_glpiagent]&quot; --set-forcerun" Execute="immediate" />
426450
<CustomAction Id="ForceRun" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
427451
<CustomAction Id="SetRunNow" Property="RunNow" Value="&quot;[#f_glpiagent]&quot; --force" Execute="immediate" />
428452
<CustomAction Id="RunNow" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
429453

454+
[%- IF bits==32 %]
430455
<CustomAction Id="SetEndTask" Property="EndTask" Value="&quot;[SystemFolder]schtasks.exe&quot; /tn &quot;$(var.AgentName)&quot; /end" Execute="immediate" />
456+
[%- ELSE %]
457+
<CustomAction Id="SetEndTask" Property="EndTask" Value="&quot;[System64Folder]schtasks.exe&quot; /tn &quot;$(var.AgentName)&quot; /end" Execute="immediate" />
458+
[%- END %]
431459
<CustomAction Id="EndTask" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
460+
[%- IF bits==32 %]
432461
<CustomAction Id="SetDeleteTask" Property="DeleteTask" Value="&quot;[SystemFolder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /delete" Execute="immediate" />
462+
[%- ELSE %]
463+
<CustomAction Id="SetDeleteTask" Property="DeleteTask" Value="&quot;[System64Folder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /delete" Execute="immediate" />
464+
[%- END %]
433465
<CustomAction Id="DeleteTask" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
466+
[%- IF bits==32 %]
434467
<CustomAction Id="SetTaskMinute" Property="TaskMinute" Value="&quot;[SystemFolder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc minute /mo [TASK_MINUTE_MODIFIER]" Execute="immediate" />
468+
[%- ELSE %]
469+
<CustomAction Id="SetTaskMinute" Property="TaskMinute" Value="&quot;[System64Folder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc minute /mo [TASK_MINUTE_MODIFIER]" Execute="immediate" />
470+
[%- END %]
435471
<CustomAction Id="TaskMinute" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
472+
[%- IF bits==32 %]
436473
<CustomAction Id="SetTaskHourly" Property="TaskHourly" Value="&quot;[SystemFolder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc hourly /mo [TASK_HOURLY_MODIFIER]" Execute="immediate" />
474+
[%- ELSE %]
475+
<CustomAction Id="SetTaskHourly" Property="TaskHourly" Value="&quot;[System64Folder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc hourly /mo [TASK_HOURLY_MODIFIER]" Execute="immediate" />
476+
[%- END %]
437477
<CustomAction Id="TaskHourly" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
478+
[%- IF bits==32 %]
438479
<CustomAction Id="SetTaskDaily" Property="TaskDaily" Value="&quot;[SystemFolder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc daily /mo [TASK_DAILY_MODIFIER]" Execute="immediate" />
480+
[%- ELSE %]
481+
<CustomAction Id="SetTaskDaily" Property="TaskDaily" Value="&quot;[System64Folder]schtasks.exe&quot; /f /tn &quot;$(var.AgentName)&quot; /create /ru system /tr '&quot;[#f_glpiagent]&quot;' /sc daily /mo [TASK_DAILY_MODIFIER]" Execute="immediate" />
482+
[%- END %]
439483
<CustomAction Id="TaskDaily" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="ignore" Impersonate="no"/>
440484

485+
<!-- Support dedicated CustomActions to handle CVE-2024-28241 -->
486+
[%- IF bits==32 %]
441487
<CustomAction Id="SetFixInstallDir" Property="FixInstallDir" Value="&quot;[SystemFolder]icacls.exe&quot; &quot;[INSTALLDIR].&quot; /inheritance:r" Execute="immediate" />
488+
[%- ELSE %]
489+
<CustomAction Id="SetFixInstallDir" Property="FixInstallDir" Value="&quot;[System64Folder]icacls.exe&quot; &quot;[INSTALLDIR].&quot; /inheritance:r" Execute="immediate" />
490+
[%- END %]
442491
<CustomAction Id="FixInstallDir" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="check" Impersonate="no"/>
443492
<CustomAction Id="UpdateLocalDir" Property="LOCAL" Value="[LOCAL]\" Execute="immediate" />
493+
[%- IF bits==32 %]
444494
<CustomAction Id="SetFixLocalDir" Property="FixLocalDir" Value="&quot;[SystemFolder]icacls.exe&quot; &quot;[LOCAL].&quot; /inheritance:r" Execute="immediate" />
495+
[%- ELSE %]
496+
<CustomAction Id="SetFixLocalDir" Property="FixLocalDir" Value="&quot;[System64Folder]icacls.exe&quot; &quot;[LOCAL].&quot; /inheritance:r" Execute="immediate" />
497+
[%- END %]
445498
<CustomAction Id="FixLocalDir" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Return="check" Impersonate="no"/>
446499

447500
<CustomAction Id="SetCheckRunningAsAdmin" Property="WixQuietExecCmdLine" Value="&quot;[SystemFolder]net.exe&quot; file" Execute="immediate" />
@@ -464,17 +517,17 @@
464517
<LaunchConditions Sequence="200" />
465518

466519
[%- IF bits==32 %]
467-
<Custom Action="SchedSecureObjects" After="CreateFolders"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
468-
<Custom Action="SetFixInstallDir" After="SchedSecureObjects"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
469-
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT INSTALLDIR<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
470-
<Custom Action="SetFixLocalDir" After="SchedSecureObjects"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
471-
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
520+
<Custom Action="SchedSecureObjects" After="CreateFolders"><![CDATA[NOT (INSTALLDIR<<ProgramFilesFolder AND (NOT LOCAL OR LOCAL<<ProgramFilesFolder)) AND NOT REMOVE~="ALL"]]></Custom>
521+
<Custom Action="SetFixInstallDir" After="SchedSecureObjects"><![CDATA[NOT (INSTALLDIR<<ProgramFilesFolder AND (NOT LOCAL OR LOCAL<<ProgramFilesFolder)) AND NOT REMOVE~="ALL"]]></Custom>
522+
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT (INSTALLDIR<<ProgramFilesFolder AND (NOT LOCAL OR LOCAL<<ProgramFilesFolder)) AND NOT REMOVE~="ALL"]]></Custom>
523+
<Custom Action="SetFixLocalDir" After="SchedSecureObjects"><![CDATA[LOCAL<>"" AND NOT (INSTALLDIR<<ProgramFilesFolder AND LOCAL<<ProgramFilesFolder) AND NOT REMOVE~="ALL"]]></Custom>
524+
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT (INSTALLDIR<<ProgramFilesFolder AND LOCAL<<ProgramFilesFolder) AND NOT REMOVE~="ALL"]]></Custom>
472525
[%- ELSE %]
473-
<Custom Action="SchedSecureObjects_x64" After="CreateFolders"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
474-
<Custom Action="SetFixInstallDir" After="SchedSecureObjects_x64"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
475-
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT INSTALLDIR<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
476-
<Custom Action="SetFixLocalDir" After="SchedSecureObjects_x64"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFiles64Folder AND NOT REMOVE~="ALL"]]></Custom>
477-
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT LOCAL<<ProgramFilesFolder AND NOT REMOVE~="ALL"]]></Custom>
526+
<Custom Action="SchedSecureObjects_x64" After="CreateFolders"><![CDATA[NOT (INSTALLDIR<<ProgramFiles64Folder AND (NOT LOCAL OR LOCAL<<ProgramFiles64Folder)) AND NOT REMOVE~="ALL"]]></Custom>
527+
<Custom Action="SetFixInstallDir" After="SchedSecureObjects_x64"><![CDATA[NOT (INSTALLDIR<<ProgramFiles64Folder AND (NOT LOCAL OR LOCAL<<ProgramFiles64Folder)) AND NOT REMOVE~="ALL"]]></Custom>
528+
<Custom Action="FixInstallDir" After="SetFixInstallDir"><![CDATA[NOT (INSTALLDIR<<ProgramFiles64Folder AND (NOT LOCAL OR LOCAL<<ProgramFiles64Folder)) AND NOT REMOVE~="ALL"]]></Custom>
529+
<Custom Action="SetFixLocalDir" After="SchedSecureObjects_x64"><![CDATA[LOCAL<>"" AND NOT (INSTALLDIR<<ProgramFiles64Folder AND LOCAL<<ProgramFiles64Folder) AND NOT REMOVE~="ALL"]]></Custom>
530+
<Custom Action="FixLocalDir" After="SetFixLocalDir"><![CDATA[LOCAL<>"" AND NOT (INSTALLDIR<<ProgramFiles64Folder AND LOCAL<<ProgramFiles64Folder) AND NOT REMOVE~="ALL"]]></Custom>
478531
[%- END %]
479532
<Custom Action="UpdateLocalDir" Before="CostFinalize"><![CDATA[LOCAL<>"" AND NOT LOCAL>>"\" AND NOT REMOVE~="ALL"]]></Custom>
480533

0 commit comments

Comments
 (0)