sentry-native
sentry-native copied to clipboard
getsentry
File permissions of settings.dat on Windows machines with strict folder restrictions
Description
This issue only affects Windows machines with very strict restrictions on files in folders.
By default the settings.dat database is saved in the same location as the sentry.dll. You can change the location to a bespoke location e.g. programdata or appdata to try and avoid folder level restrictions for non admin users.
When the file is saved to these locations the permissions of the file has restricted write access. If you work in an enterprise (like I do) with very strict permissions then sentry initialisation fails as the file can be written but not updated.
We've hacked around this by explicitly setting the permissions of the file after initialisation but it would be great if this could be done in the SDK.
When does the problem happen
- [ ] During build
- [ ] During run-time
- [ ] When capturing a hard crash
- [x] When initialising sentry
Environment
- OS: Windows 10, 64-bit
- Compiler: MSVC 19
- CMake version and config: 3.17.2, SENTRY_BACKEND=crashpad
Steps To Reproduce
n/a on initialisation
Log output
n/a
Is sentry_options_set_database_path() helps you?
https://github.com/getsentry/sentry-native/blob/master/include/sentry.h#L845-L875
yes, we are using that and putting the file in AppData/local as suggested in the readme https://github.com/getsentry/sentry-native#runtime-configuration
The issue however is the created file doesn't have write permissions open to every user on the system. Read permissions are open to every user not write.
We fixed this locally by changing the permissions on the file to allow write from any user.
It would be good to change the write permissions in the crashpad code here: https://github.com/getsentry/crashpad/blob/2820e975693bc738ef3e40b5a9ef4244880b8034/client/crash_report_database.cc
But in case of %LOCALAPPDATA% it is OK to restrict other users access to the file.
Each user will have its own database in his %USERPROFILE%/AppData/Local folder.
@Mixaill The user who owns the %USERPROFILE%/AppData/Local doesn't have access to write to the file. This isn't an issue if you don't have an operating system with very restricted access. I can write to the file using my non-work laptop or VM but I have full Admin access on both of those machines.
The issue however is the created file doesn't have write permissions open to every user on the system. Read permissions are open to every user not write.
We fixed this locally by changing the permissions on the file to allow write from any user.
I’m wondering why you would want to run sentry with a different user than the one that originally created the run folder?
Not sure if this is actually actionable or rather a configuration problem outside of our codebase?
