feat: extract admin rights check and do it also for windows (#1861)

Author: alvarocabanas

.github/workflows/push_pr_checks_tests.yml

@@ -455,16 +455,21 @@ jobs:
         if: '!cancelled()'
         run: cargo test --workspace --exclude 'newrelic_agent_control' --all-targets
 
-      - name: Run tests agent control lib excluding root-required tests (on-host)
+      - name: Run tests agent control lib
         if: '!cancelled()'
         shell: bash
         run: make -C agent-control test/onhost
 
-      - name: Run integration tests
+      - name: Run integration tests excluding non root-required tests only available for unix (on-host)
         if: '!cancelled()'
         shell: bash
         run: make -C agent-control test/onhost/integration
 
+      - name: Run onHost root-required integration-tests only (windows runner has elevated permissions)
+        if: '!cancelled()'
+        shell: bash
+        run: make -C agent-control test/onhost/root/integration
+
       - name: Run documentation tests
         if: '!cancelled()'
         run: cargo test --locked --doc

Cargo.lock

@@ -44,6 +44,7 @@ reqwest = { version = "0.12.24", default-features = false, features = [
 ] }
 rstest = "0.26.1"
 windows = "0.62.2"
+windows-sys = "0.61.2"
 
 [profile.release]
 # remove debug symbols from the release binary

Cargo.toml

@@ -81,6 +81,9 @@ windows = { workspace = true, features = [
   "Win32_System_Threading",
 ] }
 
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { workspace = true }
+
 [dev-dependencies]
 assert_cmd = { workspace = true }
 predicates = { workspace = true }

agent-control/Cargo.toml

@@ -12,6 +12,7 @@ use newrelic_agent_control::event::ApplicationEvent;
 use newrelic_agent_control::event::channel::{EventPublisher, pub_sub};
 use newrelic_agent_control::http::tls::install_rustls_default_crypto_provider;
 use newrelic_agent_control::instrumentation::tracing::TracingGuardBox;
+use newrelic_agent_control::utils::is_elevated::is_elevated;
 use std::error::Error;
 use std::process::ExitCode;
 use tracing::{error, info, trace};
@@ -36,9 +37,9 @@ fn _main(
     agent_control_run_config: AgentControlRunConfig,
     _tracer: Vec<TracingGuardBox>, // Needs to take ownership of the tracer as it can be shutdown on drop
 ) -> Result<(), Box<dyn Error>> {
-    #[cfg(all(target_family = "unix", not(feature = "disable-asroot")))]
-    if !nix::unistd::Uid::effective().is_root() {
-        return Err("Program must run as root".into());
+    #[cfg(not(feature = "disable-asroot"))]
+    if !is_elevated()? {
+        return Err("Program must run with elevated permissions".into());
     }
 
     #[cfg(not(feature = "multiple-instances"))]

agent-control/src/bin/main_onhost.rs

@@ -1,4 +1,5 @@
 pub mod binary_metadata;
+pub mod is_elevated;
 pub mod retry;
 pub mod thread_context;
 pub mod threads;

agent-control/src/utils.rs

@@ -0,0 +1,59 @@
+#[cfg(target_family = "windows")]
+use windows_sys::Win32::Foundation::{CloseHandle, HANDLE};
+#[cfg(target_family = "windows")]
+use windows_sys::Win32::Security::{
+    GetTokenInformation, TOKEN_ELEVATION, TOKEN_QUERY, TokenElevation,
+};
+#[cfg(target_family = "windows")]
+use windows_sys::Win32::System::Threading::{GetCurrentProcess, OpenProcessToken};
+
+#[derive(Debug, thiserror::Error)]
+#[error("{0}")]
+pub struct IsElevatedError(String);
+
+pub fn is_elevated() -> Result<bool, IsElevatedError> {
+    #[cfg(target_family = "unix")]
+    return Ok(nix::unistd::Uid::effective().is_root());
+
+    #[cfg(target_family = "windows")]
+    is_elevated_windows()
+}
+
+#[cfg(target_family = "windows")]
+fn is_elevated_windows() -> Result<bool, IsElevatedError> {
+    unsafe {
+        let mut token_handle: HANDLE = std::ptr::null_mut();
+        let process = GetCurrentProcess();
+
+        // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken
+        // An access token contains the security information for a logon session and every process
+        // executed on behalf of the user has a copy of the token. Here we get that token.
+        if OpenProcessToken(process, TOKEN_QUERY, &mut token_handle) == 0 {
+            return Err(IsElevatedError("Failed to open process token.".to_string()));
+        }
+
+        let mut elevation = TOKEN_ELEVATION { TokenIsElevated: 0 };
+        let mut return_length = 0;
+
+        // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-gettokeninformation
+        // GetTokenInformation requires a pointer to a buffer (elevation) the function fills with the requested information.
+        // The second parameter is the class (TokenElevation) we want to get information from the Token.
+        let result = GetTokenInformation(
+            token_handle,
+            TokenElevation,
+            &mut elevation as *mut _ as *mut _,
+            std::mem::size_of::<TOKEN_ELEVATION>() as u32,
+            &mut return_length,
+        );
+
+        CloseHandle(token_handle);
+
+        if result == 0 {
+            return Err(IsElevatedError(
+                "Failed to get token information to check user rights.".to_string(),
+            ));
+        }
+
+        Ok(elevation.TokenIsElevated != 0)
+    }
+}

agent-control/src/utils/is_elevated.rs

@@ -67,9 +67,9 @@ fn does_not_run_if_no_root() -> Result<(), Box<dyn std::error::Error>> {
     )?;
     let mut cmd = cargo_bin_cmd!("newrelic-agent-control");
     cmd.arg("--local-dir").arg(dir.path());
-    cmd.assert()
-        .failure()
-        .stdout(predicate::str::contains("Program must run as root"));
+    cmd.assert().failure().stdout(predicate::str::contains(
+        "Program must run with elevated permissions",
+    ));
     Ok(())
 }
 

agent-control/tests/on_host/cli.rs

@@ -48,8 +48,10 @@ fn default_log_level_no_root() {
     // Expecting to fail as non_root
     // Asserting content is logged to stdout as well
     cmd.assert().failure().stdout(
-        predicate::str::is_match(TIME_FORMAT.to_owned() + "ERROR.*Program must run as root")
-            .unwrap(),
+        predicate::str::is_match(
+            TIME_FORMAT.to_owned() + "ERROR.*Program must run with elevated permissions",
+        )
+        .unwrap(),
     );
 
     // The behavior of the appender functionality is already unit tested as part of the sub-agent

agent-control/tests/on_host/logging/file_logging.rs

@@ -46,8 +46,10 @@ fn default_log_level_no_root() {
             .unwrap(),
         )
         .stdout(
-            predicate::str::is_match(TIME_FORMAT.to_owned() + "ERROR.*Program must run as root")
-                .unwrap(),
+            predicate::str::is_match(
+                TIME_FORMAT.to_owned() + "ERROR.*Program must run with elevated permissions",
+            )
+            .unwrap(),
         );
 }
 
@@ -122,8 +124,10 @@ fn debug_log_level_no_root() {
             .unwrap(),
         )
         .stdout(
-            predicate::str::is_match(TIME_FORMAT.to_owned() + "ERROR.*Program must run as root")
-                .unwrap(),
+            predicate::str::is_match(
+                TIME_FORMAT.to_owned() + "ERROR.*Program must run with elevated permissions",
+            )
+            .unwrap(),
         );
 }