NativeProcess fails to work correctly with UAC

[Guest]

Hi there,

I'm using AIR 2's NativeProcess API to run a downloaded update for my application.

On computers without UAC enabled, this works fine, when calling NativeProcess.start(), it starts the installer and runs absolutely fine.

On computers with UAC enabled however, after calling NativeProcess.start(), it stops, and does not run any of the lines of code after it within the function. (In my case, it creates a log message and then calls NativeApplication.nativeApplication.exit(), but I also tested with a trace statement before and after; the trace after calling NativeProcess.start never displayed.)

I am also elsewhere in the application starting javaw.exe to make use of the merapi bridge/amf messaging. Starting javaw works with UAC enabled. It seems this issue may be isolated to installation programs that come up with a UAC warning "This program is about to make changes to your computer" type message.

I also tried using File.openWithDefaultApplication to open the directory containing the installer, but this _also_ doesn't work on the machines with UAC enabled!

Is there any work-around for this problem as I can't use the applicationupdater (since it's targeted at .air only at the moment) and I can't execute the downloaded file nor navigate the user to the downloaded directory!

Any help would be greatly appreciated!

Adam

[chris.campbell]

Hi Adam,

Thanks for bringing this issue up.  I'm looking into it now and will get back as soon as I have more info.  I believe other's have been able to accomplish native installer updates, but I haven't heard any discussion about UAC.  Does this only occur with installed applications or do you see this under the debugger too?

Thanks,

Chris

[Guest]

Hi Chris,

Thanks for the quick response! The machines which are having problems unfortunately don't have flex builder installed as they are just test machines, so I haven't been able to test if the problem also exists when run using adl through flex builder.

It seems to affect some machines with UAC enabled but not others, after testing three windows 7 machines today, all of them worked fine and exactly as intended, with or without UAC enabled, as did one machine running vista. A second vista machine and a windows 7 machine that has been upgraded from vista both have the problems described.

The problem also appears when downloading the Java JDK 7 through AIR and trying to execute the file on those machines. As with the download of the AppUpdater.exe, absolutely nothing happens, but manually executing the file works correctly, displaying the 'This file will make changed to your computer' dialog before installing.

Please let me know if there is anything else I can do to help diagnose the issue.

Regards,

Adam

[chris.campbell]

Hi Adam,

I played around with the new NativeApplicationUpdater API's released recently by Piotr Walczyszyn on Windows 7, but I didn't run into any problems with UAC.  However, it sounds like it might not be an issue with Win 7, but specific to Vista?

I asked one of the developers that worked on this feature and here's what he had to say:

On a machine with UAC you cannot use the NativeProcess API to launch an installer. The reason for this is because the NativeProcess API uses CreateProcess internally and the CreateProcess API is not able to elevate privileges. The windows API that does allow for privilege elevation is ShellExecute. You should be able to launch the installer directly using File.openWithDefaultApplication since internally it uses ShellExecute. If File.openWithDefaultApplication isn’t working it may be due one or more possible problems: If you are not in the ExtendedDesktop profile File.openWithDefaultApplication will not launch EXE files.  This seems unlikely since the forum post indicates that they were able to used NativeProcess (also requires ExtendedDesktop) to launch a Java process. The other issue might be the name of the installer. If the Installer is named Setup.exe, then the OS will attempt privilege elevation, but otherwise the installer must do this elevation itself. The Installer must run with elevated privilege in order to actually work on a UAC machine.

So the short answer is  NativeProcess won’t work on UAC machines by design, but File.openWithDefaultApplication should so. If it doesn’t then we need more info from the user.

After rereading that, I believe I might not have seen the issue because I named my installer "setup.exe" during my tests last friday.  I'll follow up with Piotr to see which API (native process or openWithDefaultApplication) he's using.  I'll also try using File.openWithDefaultApplication on a Vista machine.

Thanks,

Chris

[Guest]

Hi Chris,

I've been away for a short while so I've not been able to look into this again.

There is definitely still an issue with this, as if the CreateProcess API used by the NativeProcess API is unable to elevate privileges, then we have no way to run install files on a UAC machine.

File.openWithDefaultApplication is limited by design to not open executable files so unfortunately is not an option! (see http://cookbooks.adobe.com/post_Open_file_with_Default_Application_AIR_2_0-16745.html)

I will test tomorrow to see if I can run a file named Setup.exe with either function. If this doesn't work, then perhaps it is impossible to create an application updater that works on machines using UAC!

[Guest]

Hi again Chris,

I've just tested this morning and if I rename the file 'Setup.exe' then it still fails to run.

I do however have a trace from within Flex Builder this time however:

Error: Error #3219: The NativeProcess could not be started. 'The requested operation requires elevation.

'

at flash.desktop::NativeProcess/internalStart()

at flash.desktop::NativeProcess/start()

It seems the NativeProcess can't elevate privileges even if it is named Setup.exe

I think I have a couple of possible workarounds but they're hardly pretty. Will post again if either of them work

[chris.campbell]

ArK_1 wrote:

It seems the NativeProcess can't elevate privileges even if it is named Setup.exe

I think I have a couple of possible workarounds but they're hardly pretty. Will post again if either of them work

I think my previous test was invalid, as I discovered that I was running under an administrator account which would do the elevation correctly.  I believe the correct route would be to use File.openWithDefaultApplication (using extended desktop).  Give that a try if you can and let me know how it goes.

Thanks,

Chris

[Guest]

Hi Chris,

I hadn't found that information that extendedDesktop allowed executables to run with File.openWithDefaultApplication(), I've just tried to use it to open the installer and so far it seems to work perfectly, thanks for your help!

[chris.campbell]

Great to hear and thanks for getting back to us.  Please let me know if you run into any additional problems.

Chris

[rafal_drag]

Hi Chris (and others of course),

recently I've stuck on the same problem. in my case I want to launch ImageMagick binary to perform image scaling for further usage with AIR app. However, on machines with UAC on, I got error 3219. is/will there be any workaround for this?

I'd really appreciate any clues/suggestions.

regards

[chris.campbell]

Hello,

Could you provide some sample code so I can try reproducing the error?  I'm surprised you're having issues with ImageMagick and I'm curious what could be causing privilege issues.  I'm not sure what error 3219 is so I'll have to investigate that.  If you'd prefer sending the code privately, please feel free to email me at ccampbel@adobe.com.

Thanks,

Chris

[rafal_drag]

of course, please take a look:

public function Convert( args:Vector.<String>, inFile:File, outFile:File = null ) {

var pi:NativeProcessStartupInfo = new NativeProcessStartupInfo();

var os:String = Capabilities.os.toLowerCase();

if( os.indexOf("win") >= 0 ){

  pi.executable = File.applicationDirectory.resolvePath("imagick/win32/convert.exe");

} else if( os.indexOf( "mac" ) >= 0 ){

  pi.executable = File.applicationDirectory.resolvePath("imagick/macosx/bin/convert");

} else {

  notifyError( "Unsupported OS" );

  return;

}

try {

  _in = inFile;

  _tmp = File.createTempDirectory().resolvePath('tmp.' + inFile.extension);

  inFile.copyTo(_tmp,true);

  args.unshift( _tmp.nativePath );

  if( outFile != null ){

   _out = outFile;

   args.push( outFile.nativePath );

  }

  pi.arguments = args;

  setTimeout( _start, 50, pi );

} catch( er:IOError ){

  notifyError( "Nie można utworzyć pliku tymczasowego." );

}

}

private function _start( pi:NativeProcessStartupInfo ):void {

with( new NativeProcess() ){

  addEventListener( ProgressEvent.STANDARD_ERROR_DATA, onStdOut );

  addEventListener( ProgressEvent.STANDARD_ERROR_DATA, removeTmp );

  addEventListener( ProgressEvent.STANDARD_INPUT_PROGRESS, onStdOut );

  addEventListener( ProgressEvent.STANDARD_INPUT_PROGRESS, removeTmp );

  addEventListener( ProgressEvent.STANDARD_OUTPUT_DATA, onStdOut );

  addEventListener( ProgressEvent.STANDARD_OUTPUT_DATA, removeTmp );

  addEventListener( NativeProcessExitEvent.EXIT, onProcComplete );

  addEventListener( NativeProcessExitEvent.EXIT, removeTmp );

  start(pi);

}

dispatchEvent( new Event( CONVERT_START ) );

}

error is thrown by _start function and the stack trace is:

Error: Error #3219: The NativeProcess could not be started. 'Nie można uruchomić aplikacji, ponieważ jej konfiguracja równoczesna jest niepoprawna. Więcej szczegółów można znaleźć w dzienniku zdarzeń aplikacji lub przy użyciu narzędzia wiersza polecenia sxtrace.exe.'

at flash.desktop::NativeProcess/internalStart()

at flash.desktop::NativeProcess/start()

at someproject.classes::Convert/_start()

at Function/http://adobe.com/AS3/2006/builtin::apply()

at SetIntervalTimer/onTimer()

at flash.utils::Timer/_timerDispatch()

at flash.utils::Timer/tick()

on Windows XP this code works fine, on Win 7 with UAC turned off - also.

thank you for your time

regards

[chris.campbell]

Thanks for the code and exact error, I assume this also works for the Mac?.  I'll grab ImageMagick, try this out, and I'll let you know what I find.

Thanks,

Chris

[chris.campbell]

Hi Rafal,

Thanks again for the code sample.  Unfortunately, I haven't been able to reproduce the problem you reported.  I tried on both an administrator and standard Win 7 accounts with both a debug and release build of my test app.  If you can, please check out my sample fpx file and let me know if it also throws error for you.

Thanks,

Chris

[rafal_drag]

Hi Chris,

thanks for your response.

Unfortunately, I encountered other problem on Windows Vista with UAC turned on. I constantly get exit code 1, nevermind what file location I select. on Win 7 everything works fine. Got to investigate it deeper.

[northcode]

To get around UAC when launching an installer you'll have to use two EXE files. The first one runs without elevated privileges and it will launch your installer (or app that requires elevated prviileges) using the Windows ShellExecute API. It will never work with CreateProcess because the child application can't have a higher privilege level than the parent. Ever. That's baked in now when UAC is enabled.

Tim Goss

Northcode Inc.

[chris.campbell]

ArK_1 wrote:

File.openWithDefaultApplication is limited by design to not open executable files so unfortunately is not an option! (seehttp://cookbooks.adobe.com/post_Open_file_with_Default_Application_AIR _2_0-16745.html)

While normally File.openWithDefaultApplication is limited in what it can access, if you use the extendedDesktop profile you can open executable files.

Here's what the Application profiles document has to say:

Extended desktop profile application can call File.openWithDefaultApplication() for files of any type. The restrictions that apply in the desktop profile do not apply in the extended desktop profile. The method File.openWithDefaultApplication() lets you open in the default application registered in the operating system to open the file.

Chris

[TKRUVGT]

Try executing osk.exe the default on screen keyboard in windows 7, the native process will fail.