[Benoît Cortier (CBenoit)]

The installer keeps the Gateway's configuration, keys and databases under %ProgramData%\Devolutions\Gateway and writes there as SYSTEM, but it accepted that folder whatever its owner, applied only the DACL from its SDDL so the folder kept the owner it had, and reset the permissions of the files below by path, following any junction in the tree.
It also gave LOCAL SERVICE write access to the folder and to users.txt, and the service account the right to delete the folder itself.
The Gateway trusts what it reads from that folder, so an account that owned or could replace it could keep control of the Gateway's configuration.

The installer now:

• refuses an install, upgrade, repair or feature change, before it changes anything, with a localized error naming the folder and the account, when Devolutions or Gateway is a link, a file, can't be read, or is owned by anyone but SYSTEM, Administrators, TrustedInstaller or a member of Administrators, or when the DACL of Devolutions lets another account replace it or an entry of it; a full uninstall is never refused;
• creates a missing Gateway with its final security descriptor, or resets the owner and DACL of an existing one on the handle it checked, then gives each file and unprotected folder below the entries Gateway now passes on, removing those it passed on before, without following any link and skipping files with several hard links; a protected folder keeps its DACL, and users.txt keeps its own until its reset;
• sets the owner and DACL of users.txt through its handle, refusing a link or a hard-linked file;
• gives LOCAL SERVICE no entry, removes any it holds below the folder, and gives the service account no right to delete or rename the folder itself, keeping its rights on everything below.

Issue: DGW-478
Security: yes

🤖 Generated with Claude Code

[Benoît Cortier (CBenoit)]

Validation

Head 2dbfc5355; the build and tests below ran at e344a87eb, which differs from the head only by a comment.

• Lines changed: production code +1624 −109 (package/WindowsManaged/Actions/*.cs, Program.cs, Resources/Includes.cs), tests +1348 −0 (new package/WindowsManaged.UnitTests), localization resources +95 −0, intent and CI +23 −1.
• dotnet test package/WindowsManaged.UnitTests/DevolutionsGateway.Installer.Tests.csproj: 109 passed, 0 failed, without elevation; the new gateway-installer-tests CI job runs it.
• dotnet test package/AgentWindowsManaged.Tests: 82 passed, 0 failed (unchanged project, run to check nothing shared broke).
• ci/check-oracle-markers.ps1 -Base e8a4b082b: passes.
• MSI built locally with placeholder payloads; InstallExecuteSequence: InstallInitialize 1500, CA.checkProgramDataDirectory 1503 (NOT (REMOVE="ALL")), RemoveExistingProducts 1504, CreateFolders 3700, CA.createProgramDataDirectory 3702, CA.setUserDatabasePermissions 6597, InstallFinalize 6600; all three are deferred, not impersonated, and checked.
• Session.FormatRecord on the refusal record, in a session where SECRET is set, returns a text holding [SECRET], lone brackets and [\[] unchanged; the same test fails when the text goes in a record field or unescaped in the format string.
• Mutations applied by hand and reverted (not a mutation tool run): comparing stale entries against the new parent instead of the previous one, skipping the conversion, restoring DELETE on the folder, restoring the LOCAL SERVICE entry, and recomputing a protected folder each fail at least one test.
• Six independent review rounds; the last found nothing blocking.

Intent

package/WindowsManaged/INTENT.md (Data folder) is new and was approved verbatim by the maintainer before the code.
Audit against it:

• Owner and permissions set on creation and reset on every install, upgrade and repair: conforms (DataFolders.Create).
• Only SYSTEM and administrators can rename or replace the folder: conforms (no DELETE for the service account on the folder itself; the Devolutions DACL rule).
• Only SYSTEM, administrators and the service account can change what the Gateway stores there: partial, see Known limits.
• Refusal before any change, localized, naming folder and account; uninstall never refused: conforms (CA.checkProgramDataDirectory before RemoveExistingProducts, re-checked in Create).
• No link followed when setting security: conforms (every open uses FILE_FLAG_OPEN_REPARSE_POINT, decisions from the handle, hard-linked files skipped or refused).

Decisions

• Refuse rather than repair, as the Agent installer does, because the Gateway trusts the configuration and keys it finds in the folder.
• The Devolutions DACL rule accepts an entry for a member of Administrators, as the owner rule accepts that account; the Agent installer and the agent's own ancestor check still refuse it, and are to be aligned separately.
• LOCAL SERVICE has no entry, and the reset removes its entries below the folder; the installer already refuses it as the service account.
• A folder below the data folder that an administrator protected keeps its DACL, apart from LOCAL SERVICE entries.
• The folder-security code is a copy of the Agent installer's, adapted; the two installers share no code today.

Known limits

• The reset changes DACLs only: an entry below the folder keeps its owner, so after a change of service account the previous account still owns, and may change the security of, the files it created.
• A protected folder below the data folder keeps its other explicit entries.
• users.txt that is a link or a hard link fails the run late, with the generic installer error rather than a named one.
• A Devolutions folder whose DACL gives a non-administrator account a replace right blocks install, upgrade and repair until an administrator fixes it; the error names the account.
• The German strings need a native speaker's review.
• Other installer messages still let Windows Installer read brackets in their text as property references: ValidateServiceAccount puts its text in the format string, the exception logging inserts e.ToString() as a record field. The Agent installer already escapes its texts the same way.
• A refusal naming a folder whose path holds a brace group with a bracket inside, such as {[x]}, loses those braces, and the log line written just before the error reads brackets in the path as property references; both need a redirected ProgramData with such a path.
• A failed group lookup logs the exception for every entry it checks, so a log can repeat it several times.

UNTESTED

• CustomActions.Refuse: a refusal is sent as InstallMessage.Error, which a silent install logs and an interactive one shows.
• DataFolders.Check/Create: an existing Gateway that is a link or has an untrusted owner is refused (needs a passing Devolutions, whose owner a non-elevated test can't set).
• DataFolders.Create: the Devolutions handle stays open until Gateway is created, or checked and reset.
• DataFolders.Create: setting the owner of an existing Gateway to SYSTEM succeeds only for a caller allowed to set another owner (the installer's SYSTEM process).
• DataFolders.Create: the entries below an existing Gateway lose what it passed on before only when reset in the same call that changes its DACL.
• DataFolders.Evaluate and SecureDirectory.IsTrustedOwner: a member of Administrators is trusted, through Authz or the local member list.
• SecureDirectory walk: each directory handle stays open until the entries below it are done, and a directory is walked only when the held handle is the entry first opened.

---

🤖 Generated with Claude Code