Skip to content

[Question] Configuring Windows Terminal profile to always launch elevated #632

Closed
Listed in
@pingzing

Description

@pingzing
Contributor

Hi! Is there a way to configure a profile so that the commandLine it launches always starts with elevated (admin) permissions?

Currently, you can launch the entire application as Administrator, but then every single commandLine runs as Administrator, which is not ideal.

Activity

zadjii-msft

zadjii-msft commented on May 9, 2019

@zadjii-msft
Member

There is not. I don't think we plan on supporting mixed elevated and unelevated tabs, because it's a bit of a security hole.

Yes I know sudo is a thing, but we've had lots of discussions with the security team about the creation of a sudo for Windows. The main problem is due to the fact that any unelevated processes can send keystrokes to any other unelevated windows.

If you had an elevated commandline running in an unelevated window, an untrusted bad actor could execute an elevation-of-privilege attack by driving the unelevated windows that's running the elevated commandline.

(as a matter of linking related threads, #146)


EDIT (Feb 14 2020)
Okay, so this comment didn't age super well. Originally, there was no plan to support this, since it wouldn't work with the single HWND we had. We're working on designing a solution that might support this in the future, but we can't commit to anything until we're sure that we can come up with an appropriately secure solution, that ensures that a lower privileged process can't drive a higher privilege terminal.

pingzing

pingzing commented on May 9, 2019

@pingzing
ContributorAuthor

Seems reasonable. I think having something like a combination of #576 (Open as Admin in the jump list), and maybe some kind of hotkey to launch an Admin session of the Terminal would solve most of my pain here.

mdtauk

mdtauk commented on May 9, 2019

@mdtauk

What about having a standard and elevated Terminal open in a single window but separate tabs?

zadjii-msft

zadjii-msft commented on May 10, 2019

@zadjii-msft
Member

@mdtauk I think that unfortunately falls under the same category. Since all the tabs are under the same HWND, the root HWND is what would need to be elevated to prevent non-elevated apps from driving the window.

ghost added
Needs-Tag-FixDoesn't match tag requirements
on May 17, 2019
added
Area-UserInterfaceIssues pertaining to the user interface of the Console or Terminal
and removed on May 17, 2019
ghost removed
Needs-Tag-FixDoesn't match tag requirements
on May 17, 2019
added
Area-ServerDown in the muck of API call servicing, interprocess communication, eventing, etc.
Needs-Tag-FixDoesn't match tag requirements
on May 17, 2019

245 remaining items

MikeChristensen

MikeChristensen commented on Sep 1, 2020

@MikeChristensen
DHowett

DHowett commented on Sep 1, 2020

@DHowett
Member

If you are having issues with gsudo please report them to @gerardog and not in this thread. Every message on this thread (this one included; sorry!) e-mails hundreds of subscribers.

I am going to lock this thread to further non-maintainer comments, as we are reaching the point where further comments aren’t moving the discussion forward a meaningful amount.

Please file new issues if you have concerns that are not covered here.

locked as off topic and limited conversation to collaborators on Sep 1, 2020
self-assigned this
on Nov 23, 2020
ghost removed
In-PRThis issue has a related PR
on Jan 11, 2022
ghost closed this as completedin #12137on Jan 12, 2022
ghost added a commit that references this issue on Jan 12, 2022
bc97af7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Area-SettingsIssues related to settings and customizability, for console or terminalIssue-FeatureComplex enough to require an in depth planning process and actual budgeted, scheduled work.Product-TerminalThe new Windows Terminal.

Type

No type

Projects

No projects

Relationships

None yet

    Participants

    @Fell@agr@kbirger@DHowett@hparadiz

    Issue actions

      [Question] Configuring Windows Terminal profile to always launch elevated · Issue #632 · microsoft/terminal