P0: Fix Machine-scope security for ProgramData bin (prevent Users write) #13

Activity

1. Kinin-Code-Offical

   added

   Priority: P0

   Type: bug

   Area: security

   P0

   security

   installer

   bugSomething isn't workingSomething isn't working

   on Dec 21, 2025
2. Kinin-Code-Offical

   added this to the P0 – Release & Security Blockers milestone on Dec 21, 2025
3. Kinin-Code-Offical commented on Dec 21, 2025

   

   Kinin-Code-Offical

   on Dec 21, 2025

   OwnerAuthor

   More actions

   Plan:

   • Tighten Inno Setup ACLs for ProgramData root/bin to remove Users modify, keep read/execute only.
   • Ensure logs remain user-writable and secrets stay admin/system only.
   • Verify no other installer paths rely on Users modify in bin.

   Risks:

   • Over-restricting permissions could break non-admin updates or proxy downloads; ensure user-level installs still use LocalAppData.

   Tests:

   • npm ci
   • npm run lint
   • npm test
   • npm run build
   • npm run package
   • npm run smoke:exe
   • npm run installer
   • npm run stage
4. Kinin-Code-Offical

   closed this as completedin #30on Dec 21, 2025
5. Kinin-Code-Offical commented on Dec 21, 2025

   

   Kinin-Code-Offical

   on Dec 21, 2025

   OwnerAuthor

   More actions

   PR merged: #30
   Merge commit: 67667fe