-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nomad run example.nomad requires Admin privileges on Windows #3491
Comments
For everyone here who has the same issues where they can't plan or run jobs via nomad without specific admin privileges: there is a possible workaround to make this possible.
|
First off: great discovery, nice to know exactly what function is being performed/blocked. Academically, I'm curious to the actual risk of allowing symbolic links. It's something done in Linux almost casually and the risk (to me) is minimal if you're not running as admin. I mean I guess someone can link and impersonate a file ... but again: only in the user space so said trojan wouldn't be elevated in anyway. Worth further investigation, at any rate and a great find! |
Quick google shows that Windows 10 already enables this by default if you enable developer mode ... so it seems times are changing: https://blogs.windows.com/buildingapps/2016/12/02/symlinks-windows-10/ |
Great to know but also really strange. |
article notes it depends on how you call/create said link. Seems you may need to do both (be in developer mode AND have said policy in place). I'm in a similar boat where my user account is simply a user (not admin) of W10 and I have to provide unique creds for admin access, so my experience has been similar to yours. I'm goign to dig more, however because, as stated, it seems like "legacy thinking" might be the culprit here more than any serious security risk (can't find anything specific on how it would be exploited unless you were an actual admin as well). |
This is the crazy thing in Windows 10 w/ symlinks: On scripts I distribute to dev, I end up always using |
Think of a global financial institution, which hardens windows os to the extent possible and getting to have exceptions to group policy is near impossible. But, hey, why would a file copy need to create a symbolic link, this itself asks for a review. |
Just encountered this today, based on all the discussion I'm still not 100% clear on what the best course of action is. |
Windows have an utility called mklink. If you try it using the following command, you'll find that the same error occurs:
Windows has 3 different ways to link files and folders:
Creating a symbolic link requires a Group Policy access as mentionned before or Developper Mode as describe for the SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE flag or using fsutil.
C++ function to create Symlink Creating a junction link only works on folders but does not require any special privilege.
C++ function to create Junction Link Creating a hard link only works on file on the same volume but does not require any special privilege.
|
Update go-getter@1.1.0 to fix #3491
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Operating system and Environment details
Windows Server 2016
Issue
nomad run example.nomad
fails with a permission error.Reproduction steps
In a non-admin powershell:
It appears the way hashicorp/go-getter is used to copy the jobfile into a temporary file doesn't work on Windows.
The text was updated successfully, but these errors were encountered: