[cpp-sp] 04/04: CPPSP-53 Rewrite Windows Installer as a '.bat' file
Codeberg
noreply at shibboleth.net
Mon Jun 29 14:38:12 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/6d9f9e4e79a0e1276994dd57a42527d8ffa5e558
commit 6d9f9e4e79a0e1276994dd57a42527d8ffa5e558
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Jun 29 13:14:49 2026 +0100
CPPSP-53 Rewrite Windows Installer as a '.bat' file
https://shibboleth.atlassian.net/browse/CPPSP-53
Significant simplification of the setacl bat file resulting from
testing.
---
WindowsInstall/setacl.bat | 82 ++++++++++++++++-------------------------------
1 file changed, 27 insertions(+), 55 deletions(-)
diff --git a/WindowsInstall/setacl.bat b/WindowsInstall/setacl.bat
index c07974bf..760fa783 100644
--- a/WindowsInstall/setacl.bat
+++ b/WindowsInstall/setacl.bat
@@ -1,6 +1,5 @@
@echo off
setlocal
-echo Just add code
Rem
Rem EXAMPLE batch file to set restrictive ACLs on a Shibboleth Hub installation.
@@ -18,9 +17,9 @@ Rem https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/under
Rem
if exist %SYSTEMROOT%\System32\INETSRV\appcmd.exe (
- Set SERVER_ACCOUNT_DEFAULT="IIS APPPOOL\DefaultAppPool"
+ Set SERVER_ACCOUNT_DEFAULT=IIS APPPOOL\DefaultAppPool
) Else (
- Set SERVER_ACCOUNT_DEFAULT="*S-1-5-19"
+ Set SERVER_ACCOUNT_DEFAULT=*S-1-5-19
Rem *S-1-5-19 is "Local Service
)
@@ -39,12 +38,8 @@ Rem Set other sids
Rem
Rem Administrators Account and LocalSystem get GENERIC_ALL to the installation
Rem
-Set ADMINISTRATORS_ACCOUNT="*S-1-5-32-544"
-Set LOCAL_SYSTEM_ACCOUNT="*S-1-5-18"
-Rem
-Rem Users get nothing
-Rem
-Set USERS_ACCOUNT="*S-1-5-32-545"
+Set ADMINISTRATORS_ACCOUNT=*S-1-5-32-544
+Set LOCAL_SYSTEM_ACCOUNT=*S-1-5-18
Rem
Rem Root of the Install
@@ -59,7 +54,12 @@ icacls "%INSTALL_ROOT%" /t /setowner %ADMINISTRATORS_ACCOUNT% /q
Rem
Rem Start to lock down
-Rem use Icacls
+Rem use Icacls and we set an ACL on the appropriate directory (lib, bin, etc, var),
+Rem specifying that this ACL is to replace what is there (/grant:r) and that it is
+Rem to break inheritance (/inheritance:r).
+Rem
+Rem The child directories and files get the correct result via inheritance.
+Rem
Rem https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
Rem
Rem /t recursive
@@ -73,64 +73,36 @@ Rem F Full
Rem GR GenericRead
Rem RD ReadData/ListDirectory
Rem X Execute
+Rem
-
-echo Protecting %INSTALL_ROOT%\lib
+SET ADMIN_ALL=%ADMINISTRATORS_ACCOUNT%:(OI)(CI)(F)
+SET LSA_ALL=%LOCAL_SYSTEM_ACCOUNT%:(OI)(CI)(F)
+SET SERVER_READ=%SERVER_ACCOUNT%:(OI)(CI)(GR,RD,X)
+SET SERVER_ALL=%SERVER_ACCOUNT%:(OI)(CI)(F)
Rem lib
Rem Admins: Everything
Rem Local System: Everything
Rem Server: ReadOnly
-Rem Esers: Nothing
-Rem directory first
-icacls "%INSTALL_ROOT%\lib" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:(OI)(CI)(F)" \
- "%LOCAL_SYSTEM_ACCOUNT%:(OI)(CI)(F)" \
- "%SERVER_ACCOUNT%:(OI)(CI)(GR,RD,X)" \
- "%USERS_ACCOUNT$:(OI)(CI)(N)"
-Rem Files
-icacls "%INSTALL_ROOT%\lib" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:F" \
- "%LOCAL_SYSTEM_ACCOUNT%:F" \
- "%SERVER_ACCOUNT%:(GR,RD,X)" \
- "%USERS_ACCOUNT$:N"
+Rem Users: Nothing (so say nothing)
+
+Rem
+Rem Turn on Echo so people know what is being done
+ at echo on
+icacls "%INSTALL_ROOT%\lib" /inheritance:r /grant:r "%ADMIN_ALL%" "%LSA_ALL%" "%SERVER_READ%"
Rem etc - same as lib
-Rem Directories
-icacls "%INSTALL_ROOT%\etc" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:(OI)(CI)(F)" \
- "%LOCAL_SYSTEM_ACCOUNT%:(OI)(CI)(F)" \
- "%SERVER_ACCOUNT%:(OI)(CI)(GR,RD,X)" \
- "%USERS_ACCOUNT$:(OI)(CI)(N)"
-Rem Lib Files
-icacls "%INSTALL_ROOT%\lib" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:F" \
- "%LOCAL_SYSTEM_ACCOUNT%:F" \
- "%SERVER_ACCOUNT%:(GR,RD,X)" \
- "%USERS_ACCOUNT$:N"
+icacls "%INSTALL_ROOT%\etc" /inheritance:r /grant:r "%ADMIN_ALL%" "%LSA_ALL%" "%SERVER_READ%"
Rem bin - same as lib
-Rem Directories
-icacls "%INSTALL_ROOT%\bin" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:(OI)(CI)(F)" \
- "%LOCAL_SYSTEM_ACCOUNT%:(OI)(CI)(F)" \
- "%SERVER_ACCOUNT%:(OI)(CI)(GR,RD,X)" \
- "%USERS_ACCOUNT$:(OI)(CI)(N)"
-Rem Lib Files
-icacls "%INSTALL_ROOT%\bin" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:F" \
- "%LOCAL_SYSTEM_ACCOUNT%:F" \
- "%SERVER_ACCOUNT%:(GR,RD,X)" \
- "%USERS_ACCOUNT$:N"
+icacls "%INSTALL_ROOT%\bin" /inheritance:r /grant:r "%ADMIN_ALL%" "%LSA_ALL%" "%SERVER_READ%"
+
Rem cache
Rem Admins: Everything
Rem Local System: Everything
Rem Server: Everything
-Rem Esers: Nothing
-Rem directory first
-Rem Directories
-icacls "%INSTALL_ROOT%\cache" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:(OI)(CI)(F)" \
- "%LOCAL_SYSTEM_ACCOUNT%:(OI)(CI)(F)" \
- "%SERVER_ACCOUNT%:(OI)(CI)(F)" \
- "%USERS_ACCOUNT$:(OI)(CI)(N)"
-Rem Lib Files
-icacls "%INSTALL_ROOT%\cache" /t /inheritance:r /grant:r "%ADMINISTRATORS_ACCOUNT%:F" \
- "%LOCAL_SYSTEM_ACCOUNT%:F" \
- "%SERVER_ACCOUNT%:F" \
- "%USERS_ACCOUNT$:N"
+Rem Users: Nothing (so say nothing)
+
+icacls "%INSTALL_ROOT%\var" /inheritance:r /grant:r "%ADMIN_ALL%" "%LSA_ALL%" "%SERVER_ALL%"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list