Aaron Margosis' "Non-Admin" and App-Compat WebLog : LUA Buglight

LUA Buglight 2.1 released

Aaron Margosis — Tue, 03 Nov 2009 21:37:00 GMT

LUA Buglight 2.1, identifies admin-permissions issues ("LUA bugs") in desktop applications. New version supports Windows 7 (x86 and x64), Vista (x86 and x64), XP (x86 only) and corresponding Server OSes.

The download and more information is on this page:

http://blogs.msdn.com/aaron_margosis/pages/LuaBuglight.aspx

Live, on the internet...

Aaron Margosis — Tue, 16 Jun 2009 05:57:00 GMT

Ahoy, all -- Later this week I'll be appearing at a virtual roundtable hosted by Mark Russinovich, streaming live over the web. The topic is Windows 7 application compatibility. Among other things, I'll be demoing the latest (still-unreleased) updates to LUA Buglight (latest released version here).

Here are the details:

Springboard Series Virtual Roundtable

Windows 7 Application Compatibility: Your Questions Answered (Part 1)

Date: Thursday, June 18

Time: 11:00am Pacific Time

https://ms.istreamplanet.com/springboard

Windows 7, is approaching fast and from the application standpoint is very similar to Windows Vista. We’re going to examine Windows 7 application compatibility not only from the perspective of moving from Windows Vista, but also for those coming from Windows XP. Join us to discuss the most common challenges around application compatibility when coming from a legacy operating system, why changes were made along the way, compatibility technologies inside the OS and methods for getting incompatible applications to run on Windows 7. Along the way we share tips and tricks, demonstrate free tools to analyze and fix applications and answer your specific questions about application compatibility live.

In Part 2 of this Virtual Round Table discussion (planned for later this Summer/Fall), we’ll discuss the options and approaches for using virtualization tools In depth to address application incompatibilities – including presentation virtualization, desktop virtualization and application virtualization. We’ll be sending out more details and posting information to www.microsoft.com/springboard for part 2 as the dates are finalized.

As part of the “virtual” experience, you may submit your questions about Windows 7 Application Compatibility to the panel live during the event—or submit questions in advance to vrtable@microsoft.com.

Springboard Series: The resource for Windows desktop IT professionals

"LUA Bug" demo app

Aaron Margosis — Fri, 07 Nov 2008 16:55:00 GMT

I do a lot of presentations on how to identify and fix "LUA bugs" in applications (*), both for Windows XP and Windows Vista. I frequently use a little VB6 application to demonstrate writing to various portions of the file system and registry, write to .ini files in protected locations, restart services, explicitly check for admin rights, etc. People have asked me to post that app to my blog so that they can use it too. So here it is, including the VB6 project/source code.

As is, no support, hopefully it's self-explanatory!

Chris Jackson has a more elaborate demo app with full lab script, geared toward application compatibility tools and techniques on Vista. You can get it here.

(*) "LUA" = "limited user account", a.k.a., "non-admin", "standard user"
"LUA bugs" = application or feature of an application that 1) works when run by a member of Administrators or Power Users; 2) fails when run by a standard user; and 3) has no valid business or technical reason for requiring administrative control over the computer.

LUA Buglight 2.0, second preview

Aaron Margosis — Thu, 06 Nov 2008 17:05:00 GMT

LUA Buglight is a utility that helps identify "LUA bugs" in applications -- application features that that fail as standard user but that work as administrator. I work on it in my spare time, so progress has been slow. Attached to this blog post is the second preview version of LUA Buglight 2.0.

Main changes since the previous preview:

Single executable: all the helper DLLs, EXEs, etc., are self-extracted to your temp folder when you run the program. No need to copy lots of files around.
For Vista: the helper program that requires elevation is now signed, so you get the nicer elevation prompt. The driver file for Vista is signed as well, so startup is much faster.
Explicit check for x86 -- sorry, the current version cannot be used on 64-bit versions of Windows.
Various bug fixes.

Some of the improvements of LUA Buglight 2.0 over 1.0:

Much better Vista support
Streamlined UI and improved flow
Identifies more bugs
On XP, not restricted to using a local admin account to create the "this-user-as-admin" context
On Vista, prompts for elevation just one time per session instead of for each test
Log file names autogenerated with timestamp in the name to avoid accidental overwrite of previous logs.
User options saved to the registry.

LUA Buglight 2.0 - preview

Aaron Margosis — Fri, 13 Jun 2008 07:04:00 GMT

Attached to this blog post is a PREVIEW VERSION of LUA Buglight 2.0. LUA Buglight is a utility that helps identify "LUA bugs" in desktop applications -- the bugs that appear when the application is run as a standard user instead of as an administrator.

Some of the improvements in LUA Buglight 2.0 over its predecessor:

Much better Vista support
Streamlined UI and improved flow
Identifies more bugs
On XP, not restricted to using a local account to create the admin context
On Vista, prompts for elevation just one time per session instead of for each test
User options saved to the registry

There are more improvements and refinements that I want to make, but I think you'll find it is quite usable now. And I promised some audiences here at Tech*Ed that I would post a preview version here prior to my Friday morning session introducing LUA Buglight 2.0. :-)

Note that I haven't written up new documentation yet, and that these binaries have not been signed yet.

Update, June 14: Yes - meant to mention - LUA Buglight is designed only for x86. I'll add a processor check on startup.

Update, November 6: Removing the attachment, because the Second Preview version is now available here.

Info about LUA Buglight 2.0

Aaron Margosis — Fri, 09 May 2008 23:09:00 GMT

I recently did a TechNet webcast about the upcoming LUA Buglight 2.0.

You can view the webcast here, and download the slides here.

LUA Buglight and drive mappings: Action Required

Aaron Margosis — Wed, 28 Feb 2007 06:21:00 GMT

LUA Buglight creates an alternate security context representing the current non-admin user but with admin/elevated privileges. Because that context is created in a separate logon session, none of the network connections, drive mappings or SUBST assignments of the original context are present. LUA Buglight tries to copy as many of those to the alternate context as possible. In the current version, the only ones that are not copied are those in which alternate credentials were used -- e.g., you're logged in as USER1, but connecting to network drive P: as USER2. Copying those connections would require prompting the user for passwords, etc. -- extra work that did not make the cut for version 1. All the mappings, etc., are displayed on the LUA Buglight "Credentials" tab, with the ones to be copied in the upper text box and the ones not to be copied listed in the lower text box for informational purposes.

Some users have reported cases where drives are listed in the "won't be copied" text box, showing "alternate credentials" with the same username as the logged-on user. I never saw that issue in my own testing, and haven't been able to reproduce what these users have reported.

If you have run into this issue and are willing to test a new build that tries to address the problem, please contact me via this blog's email link.

Thanks.

LUA Buglight updated information

Aaron Margosis — Fri, 16 Feb 2007 02:59:00 GMT

I've meant to provide more info and follow-up regarding LUA Buglight, the tool I wrote to help identify "LUA bugs". "LUA bugs" are the issues that cause a program to work only when run as admin (elevated). Here are some quick notes...

1. Internationalization: there is an issue when LUA Buglight is used on non-English systems -- the XML is ANSI-coded, but there is no processing instruction indicating what encoding the LuaBuglightReporter should use, so the Reporter may report an error if the system's default encoding doesn't match up. This will be fixed in the next version. In the meantime, the workaround is to open the resulting XML in Notepad, and add the following line at the beginning of the file:

<?xml version="1.0" encoding="windows-1252" ?>

You can then open the XML file with the LuaBuglightReporter. From everything I have heard, that fixes this particular issue. Please let me know if you still run into problems.

2. Cisco Network Assistant and a pretty cool, non-intrusive fix method: JohnCKirk asked here and here about issues he ran into testing Cisco Network Assistant v4.1. I downloaded it and tested for myself. I ran the installation program as Administrator in an up-to-date Windows XP SP2 image on Virtual PC. I then switched to a standard user account, and ran the program using LUA Buglight, using the target process name and startup folder specified in the shortcut that had been placed on the desktop. I was able to run the program using LUA Buglight without any problem. It reported two issues, both involving files called "LOCK" in a couple of its installation folders under %ProgramFiles%. In one case, it just tried to create the file; in the other case it tried to create the file, change its attributes, and delete the file.

When I ran the program without using LUA Buglight, the splash screen came up, and after a short while it just became stuck on one initialization step. Process Explorer showed that it was consuming lots of CPU, and Process Monitor showed it in an infinite loop alternately hitting an Access Denied trying to create one of the LOCK files and writing that fact to a log file in the current user's profile. I had to kill the process.

In order to create a file in a folder, the user needs to have permissions on the folder. However, changing ACLs on folders is much more dangerous than changing ACLs on files. What a lot of programs do when writing "test" files like LOCK is that they verify whether the file Create/Open succeeded, but don't verify whether the subsequent Delete succeeded. So, logged in as admin, I created the two LOCK files in the folders where the program tries to write them. I then granted the non-admin user "Read & Execute", "Read", and "Write" permissions on those files. Note that these permissions do not include the "Delete" permission. When I ran the program again as a non-admin user, it started up without a problem. As long as an admin doesn't delete those files, the non-admin should be able to run the program. The Create/Open always succeeds, and the Delete silently failing keeps the files there for the next time the user runs the program.

3. LUA Buglight limitations on Windows Vista: When I wrote LUA Buglight, I focused almost entirely on getting it to work on Windows XP and Windows Server 2003 -- the platforms most of my customers were using and probably will continue to use for a while. (US Federal government -- not always the quickest technology adopters. Some of them have rotary cell phones. :-) (Just kidding.) LUA Buglight works very well on XP and 2003. At the very end I spent some time building a version that would run on Windows Vista. It does, but with some limitations.

Windows Vista introduces Integrity Levels. With User Account Control, members of the Administrators group typically run with only Standard User rights, and most programs run at the Medium Integrity Level. When the admin user chooses to elevate a program (e.g., with the "Run as administrator" context menu option), it runs at High Integrity Level, with "Administrators" enabled in the access token, and powerful privileges like "Backup", "Debug", and "Load Driver", available for use.

When you test a program with LUA Buglight on Windows Vista, LUA Buglight launches an elevated helper process in order to get the "this-user-as-admin" token for use when the target program hits an "access denied" error with the normal token. The elevated helper process duplicates its token back to the Medium integrity LuaBuglight.exe process. However, a Medium integrity process cannot impersonate a High integrity token, so it won't help get past the access denied errors. So, before it duplicates it back to LuaBuglight.exe, the helper process marks it as a Medium integrity token. One side effect I discovered later is that the resulting token also has some of the more powerful privileges stripped. The "this-user-as-admin" token does have "Administrators" enabled, but it is a Medium integrity token and with some admin privileges missing. So, when the target program hits an access-denied or privilege-not-held error and the this-user-as-admin token is impersonated and the operation retried, it will succeed and be logged if the access-check depends on membership in Administrators or on any of the remaining privileges, but will fail if the access-check requires High IL to succeed or any of the missing privileges. If the operation fails when impersonating the "this-user-as-admin" token, the operation is not logged, and the app will see the access-denied error and possibly fail as a result.

The next version of LUA Buglight will address this, somehow -- but I haven't decided how yet.

4. Network drive mappings: There were some issues involving network drive mappings that were posted as comments to the original LUA Buglight blog post. I'm working on resolving those and will provide an update when I can.

MSDN webcast: LUA Buglight

Aaron Margosis — Tue, 10 Oct 2006 19:19:00 GMT

I'll be presenting an MSDN webcast and demoing LUA Buglight next Tuesday, October 17, 2006, 11:00am US Pacific time.

Click here for more information and to register. Make sure to install the Microsoft LiveMeeting client prior to showtime.

[Update, 18 Oct 2006] The webcast is now available for on-demand viewing here.

LUA Buglight public [pre]-release

Aaron Margosis — Mon, 07 Aug 2006 23:50:00 GMT

LUA Buglight™ is a tool I've been working on that is designed to help both developers and IT Pros (sysadmins) identify the specific causes of "LUA bugs" in desktop applications running on Windows XP, Windows Server 2003, or Windows Vista. Once the specific causes have been identified, the bugs can more easily be resolved by fixing the app’s source code, or by making configuration changes, allowing the app to work correctly for non-admin users.

I have written a number of pieces about LUA bugs and how to fix them (see list below). The problem has been that before you can fix them, you need to identify them. The available tools for doing so have been lacking. LUA Buglight exists to try to solve that problem.

LUA Buglight remains a work in progress, but you can download the current version here. The download is a .zip file containing a self-extracting executable that simply extracts its contents to a folder of your choosing. Those contents include a 34-page Word document -- please read it. It should answer many of your questions.

One important note: not every item that appears in the output indicates a bug that needs to be remediated! Before making any system changes, please refer to the following guidance:

What is a "LUA Bug"? (And what isn't a LUA Bug?)
Not every "access denied" indicates a LUA bug!
http://blogs.msdn.com/aaron_margosis/archive/2006/02/06/525455.aspx

Fixing "LUA bugs", Part I
A systematic approach for working around LUA bugs that avoids unnecessary exposure
http://blogs.msdn.com/aaron_margosis/archive/2006/02/16/533077.aspx

Fixing "LUA bugs", Part II
A systematic approach for working around LUA bugs that avoids unnecessary exposure - the "rest of the story"
http://blogs.msdn.com/aaron_margosis/archive/2006/03/27/562091.aspx

Changing Access Control on Folders vs. Files
More info on the risks of changing access control lists to fix LUA bugs.
http://blogs.msdn.com/aaron_margosis/archive/2006/06/19/638148.aspx

I’ll write more about LUA Buglight in the near future.

[Updates: Oct 2006 MSDN webcast; and Feb 15 2007 LUA Buglight updated information]

Update, November 6, 2008: LUA Buglight 2.0 Second Preview is now available here. Removing 1.0 from the download.