Merge branch 'windows-unprivileged-symbolic-rights' into windows-unprivileged-upgrade-testing

blakerouse · blakerouse · commit 688f9afeccc3 · 2024-05-01T10:03:47.000-04:00
diff --git a/.agent-versions.json b/.agent-versions.json
@@ -1,5 +1,6 @@
 {
   "testVersions": [
+    "8.14.0-SNAPSHOT",
     "8.13.3-SNAPSHOT",
     "8.13.2",
     "8.12.2",
diff --git a/internal/pkg/agent/install/user_windows.go b/internal/pkg/agent/install/user_windows.go
@@ -39,6 +39,8 @@ const (
 	USER_UF_SCRIPT             = 1
 	USER_UF_NORMAL_ACCOUNT     = 512
 	USER_UF_DONT_EXPIRE_PASSWD = 65536
+
+	accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"
 )
 
 // FindGID returns the group's GID on the machine.
@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to set service logon: %w", err)
 	}
+	err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)
+	if err != nil {
+		return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)
+	}
 
 	return FindUID(name)
 }

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,8 @@ const (`
`39`	`39`	`USER_UF_SCRIPT = 1`
`40`	`40`	`USER_UF_NORMAL_ACCOUNT = 512`
`41`	`41`	`USER_UF_DONT_EXPIRE_PASSWD = 65536`
	`42`	`+`
	`43`	`+ accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"`
`42`	`44`	`)`
`43`	`45`
`44`	`46`	`// FindGID returns the group's GID on the machine.`
`@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {`
`151`	`153`	`if err != nil {`
`152`	`154`	`return "", fmt.Errorf("failed to set service logon: %w", err)`
`153`	`155`	`}`
	`156`	`+ err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)`
	`157`	`+ if err != nil {`
	`158`	`+ return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)`
	`159`	`+ }`
`154`	`160`
`155`	`161`	`return FindUID(name)`
`156`	`162`	`}`